apt

SideWinder

active · last signal 2y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

RattlesnakeT-APT-04APT-C-17RAZOR TIGERHardcore Nationalist

Attribution

Suspected Indian-nexus espionage group

Origin

India (suspected)

First seen

2018

Last active

2025

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Egypt (primary MENA focus, H2 2024), Djibouti, UAE

Sectors

Maritime/port authorities, nuclear/energy agencies, government, military, diplomatic, logistics, telecom

MITRE ATT&CK

G0121 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Egypt (primary MENA focus, H2 2024), Djibouti (Maritime/port authorities, nuclear/energy agencies, government sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Tropic TrooperactorTechnique overlap
BahamutactorTechnique overlap
MuddyWateractorTechnique overlap
Gaza Cybergang / MoleratsactorTechnique overlap
WIRTEactorTechnique overlap
APT33actorTechnique overlap
Cl0pactorTechnique overlap
APT39 / ChaferactorTechnique overlap
Dust Specter

Reporting history

1 reports · 0 publishers

Third-party sources archived via ORKL — not RaqibCTI assessments. Reported since 2024-02-15.

C2024-02-15

SentinelOne WatchTower Intelligence-Driven Threat Hunting End of Year 2023

📄 PDF 📃 text ↗ ORKL ↗ source

Sources

01Sidewinder, Rattlesnake, T-APT-04, Group G0121 — MITRE ATT&CK, 2024-04 ↗02SideWinder APT Targets Maritime, Nuclear, and IT Sectors Across Asia, Middle East, and Africa — The Hacker News / Kaspersky, 2025-03 ↗03SideWinder APT targets maritime and nuclear sectors with enhanced toolset — Security Affairs, 2025-03 ↗04SideWinder Threat Group: Maritime and Nuclear Sectors at Risk with Updated Toolset ↗

Useful?