{
  "name": "SideWinder targets the maritime and nuclear sectors with an updated toolset",
  "slug": "sidewinder-targets-the-maritime-and-nuclear-sectors-with-an-updated-toolset",
  "description": "The SideWinder APT group intensified its activities in the second half of 2024, targeting maritime infrastructures, logistics companies, and nuclear sectors across Asia, the Middle East, and Africa. The group updated its toolset, including improvements to its RTF exploit, JavaScript loader, and Backdoor Loader. SideWinder's infection chain begins with spear-phishing emails containing malicious DOCX files, exploiting CVE-2017-11882 to deliver a multi-stage payload. The group demonstrated agility in evading detection, often updating their tools within hours of being identified. Notable targets included government entities, military installations, and diplomatic missions, with an increased focus on maritime and nuclear-related organizations.",
  "published": "2025-03-10T09:24:57+00:00",
  "created_at": "2025-03-10T09:24:57+00:00",
  "modified_at": "2025-03-10T11:21:40+00:00",
  "created_at_opencti": "2025-03-10T09:24:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-03-10",
    "CVE-2017-11882",
    "africa",
    "apt",
    "backdoor loader",
    "downloader module",
    "javascript",
    "maritime",
    "module installer",
    "nuclear",
    "rtf exploit",
    "south asia",
    "spear-phishing",
    "stealerbot"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://dgtk.depo-govpk.com/19263687/trui"
      },
      {
        "id": "",
        "name": "http://dgtk.depo-govpk.com/19263687/trui"
      },
      {
        "id": "",
        "name": "dgtk.depo-govpk.com"
      },
      {
        "id": "",
        "name": "ziptec.info"
      },
      {
        "id": "",
        "name": "zeltech.live"
      },
      {
        "id": "",
        "name": "veorey.live"
      },
      {
        "id": "",
        "name": "portdedjibouti.live"
      },
      {
        "id": "",
        "name": "pmd-office.info"
      },
      {
        "id": "",
        "name": "pncert.info"
      },
      {
        "id": "",
        "name": "pmd-offc.info"
      },
      {
        "id": "",
        "name": "ms-office.pro"
      },
      {
        "id": "",
        "name": "mteron.info"
      },
      {
        "id": "",
        "name": "mods.email"
      },
      {
        "id": "",
        "name": "modpak.info"
      },
      {
        "id": "",
        "name": "mod-kh.info"
      },
      {
        "id": "",
        "name": "mevron.tech"
      },
      {
        "id": "",
        "name": "file-dwnld.org"
      },
      {
        "id": "",
        "name": "downl0ad.org"
      },
      {
        "id": "",
        "name": "dowmload.co"
      },
      {
        "id": "",
        "name": "dowmloade.org"
      },
      {
        "id": "",
        "name": "documentviewer.info"
      },
      {
        "id": "",
        "name": "document-viewer.live"
      },
      {
        "id": "",
        "name": "document-viewer.info"
      },
      {
        "id": "",
        "name": "directt88.com"
      },
      {
        "id": "",
        "name": "dirctt888.com"
      },
      {
        "id": "",
        "name": "dirctt888.info"
      },
      {
        "id": "",
        "name": "dirctt88.info"
      },
      {
        "id": "",
        "name": "depo-govpk.com"
      },
      {
        "id": "",
        "name": "defencearmy.pro"
      },
      {
        "id": "",
        "name": "debcon.live"
      },
      {
        "id": "",
        "name": "d0wnlaod.org"
      },
      {
        "id": "",
        "name": "crontec.site"
      },
      {
        "id": "",
        "name": "d0wnlaod.com"
      },
      {
        "id": "",
        "name": "d0cumentview.info"
      },
      {
        "id": "",
        "name": "aliyum.email"
      },
      {
        "id": "",
        "name": "session-out.com"
      },
      {
        "id": "",
        "name": "57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce"
      },
      {
        "id": "",
        "name": "44ff1117bb0167f85d599236892deede636c358df3d8908582a6ce6a48070bd4"
      }
    ],
    "malware": [
      {
        "id": "10e6b288-115c-4ff0-b3da-2a6e7743786c",
        "name": "Module Installer",
        "slug": "module-installer"
      },
      {
        "id": "f10589f8-b190-429c-8bc7-a0dd007a2b1e",
        "name": "Downloader Module",
        "slug": "downloader-module"
      },
      {
        "id": "353cf418-a44f-42c5-8ffc-8da3ad79cb02",
        "name": "StealerBot",
        "slug": "stealerbot"
      }
    ],
    "intrusion_sets": [
      {
        "id": "30cbcbf2-21bc-489d-8705-845e05a87de5",
        "name": "SideWinder",
        "slug": "sidewinder"
      }
    ],
    "attack_patterns": [
      {
        "id": "6a8eba2e-51b0-4b6e-a733-a581dcbf4806",
        "name": "T1027.004"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2017-11882"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Djibouti"
      },
      {
        "id": "",
        "name": "Maldives"
      },
      {
        "id": "",
        "name": "Rwanda"
      },
      {
        "id": "",
        "name": "Mozambique"
      },
      {
        "id": "",
        "name": "Uganda"
      },
      {
        "id": "",
        "name": "British Indian Ocean Territory"
      },
      {
        "id": "",
        "name": "Austria"
      },
      {
        "id": "",
        "name": "Algeria"
      },
      {
        "id": "",
        "name": "Egypt"
      },
      {
        "id": "",
        "name": "Afghanistan"
      },
      {
        "id": "",
        "name": "Bulgaria"
      },
      {
        "id": "",
        "name": "Myanmar"
      },
      {
        "id": "",
        "name": "Sri Lanka"
      },
      {
        "id": "",
        "name": "Nepal"
      },
      {
        "id": "",
        "name": "Bangladesh"
      },
      {
        "id": "",
        "name": "India"
      },
      {
        "id": "",
        "name": "Saudi Arabia"
      },
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "United Arab Emirates"
      },
      {
        "id": "",
        "name": "Indonesia"
      },
      {
        "id": "",
        "name": "Cambodia"
      },
      {
        "id": "",
        "name": "Philippines"
      },
      {
        "id": "",
        "name": "Pakistan"
      },
      {
        "id": "",
        "name": "Energy"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "modpak-info.services"
      }
    ]
  },
  "external_refs": [
    "https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/",
    "https://otx.alienvault.com/pulse/67cebdf90f3d662d90cb0701"
  ]
}