{
  "name": "SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea",
  "slug": "sidewinder-utilizes-new-infrastructure-to-target-ports-and-maritime-facilities-in-the-mediterranean-sea",
  "description": "BlackBerry's researchers have uncovered a new campaign by the nation-state threat actor SideWinder. The group employs sophisticated techniques, such as utilizing carefully crafted phishing emails with visual lures designed to target specific organizations. The campaign aims to compromise ports and maritime facilities in the Indian Ocean and Mediterranean Sea regions through espionage and intelligence gathering activities. The attack chain involves exploiting vulnerabilities in Microsoft Office and downloading malicious JavaScript payloads from the group's infrastructure. SideWinder continuously evolves its tactics, making it an ongoing threat.",
  "published": "2024-07-30T13:39:40+00:00",
  "created_at": "2024-07-30T13:39:40+00:00",
  "modified_at": "2024-07-30T14:29:42+00:00",
  "created_at_opencti": "2024-07-30T13:39:40+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-30",
    "CVE-2017-0199",
    "CVE-2017-11882",
    "espionage",
    "infrastructure",
    "javascript",
    "maritime",
    "nation-state",
    "phishing",
    "targeted",
    "vulnerability"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "91.223.208.175"
      },
      {
        "id": "",
        "name": "89.150.40.43"
      },
      {
        "id": "",
        "name": "5.255.113.149"
      },
      {
        "id": "",
        "name": "5.230.35.199"
      },
      {
        "id": "",
        "name": "159.69.189.137"
      },
      {
        "id": "",
        "name": "https://reports.dgps-govtpk.com/63645534-case/doc.rtf"
      },
      {
        "id": "",
        "name": "https://salary-cutting.session-out.com/37656199_notice/doc.rtf"
      },
      {
        "id": "",
        "name": "https://mora.pdfadobe.com/d8149d32/mora/doc.rtf"
      },
      {
        "id": "",
        "name": "https://moitt-gov-pk.fia-gov.net/720705null"
      },
      {
        "id": "",
        "name": "https://moitt-gov-pk.fia-gov.net/643705null"
      },
      {
        "id": "",
        "name": "https://mofa-gov-sa.direct888.net/015094_consulategz"
      },
      {
        "id": "",
        "name": "https://mailarmylk.mods.email/Ltr86-ef2265ef"
      },
      {
        "id": "",
        "name": "https://heatwave.paknavy.store/pn/510426/doc.rtf"
      },
      {
        "id": "",
        "name": "http://investigation04.session-out.com/fbd901_harassment/doc.rtf"
      },
      {
        "id": "",
        "name": "salary-cutting.session-out.com"
      },
      {
        "id": "",
        "name": "reports.dgps-govtpk.com"
      },
      {
        "id": "",
        "name": "paknavy.dgps-govtpk.com"
      },
      {
        "id": "",
        "name": "mora.pdfadobe.com"
      },
      {
        "id": "",
        "name": "mailnepalarmymilnp.mods.email"
      },
      {
        "id": "",
        "name": "mailnepalarmymil.mods.email"
      },
      {
        "id": "",
        "name": "mailmofagovnp.mods.email"
      },
      {
        "id": "",
        "name": "mailmofagovmv.mods.emailmailmofagovnp.mods.email"
      },
      {
        "id": "",
        "name": "mailmofagovmv.mods.email"
      },
      {
        "id": "",
        "name": "mailmofagovmm.mods.email"
      },
      {
        "id": "",
        "name": "mailforegngovmv.mods.email"
      },
      {
        "id": "",
        "name": "mailarmymilbd.mods.email"
      },
      {
        "id": "",
        "name": "mailarmylk.mods.email"
      },
      {
        "id": "",
        "name": "investigation04.session-out.com"
      },
      {
        "id": "",
        "name": "mailafdgovbd.mods.email"
      },
      {
        "id": "",
        "name": "heatwave.paknavy.store"
      },
      {
        "id": "",
        "name": "gta5.mods.email"
      },
      {
        "id": "",
        "name": "ftp.mods.email"
      },
      {
        "id": "",
        "name": "session-out.com"
      },
      {
        "id": "",
        "name": "paknavy-govpk.com"
      },
      {
        "id": "",
        "name": "dgps-govtpk.com"
      },
      {
        "id": "",
        "name": "paknavy.store"
      },
      {
        "id": "",
        "name": "moitt-gov-pk.fia-gov.net"
      },
      {
        "id": "",
        "name": "mofa-gov-sa.direct888.net"
      },
      {
        "id": "",
        "name": "ceb93ee3093dbf1a49918ede81055018d9c0f0945a97f904a16951010cfbce61"
      },
      {
        "id": "",
        "name": "b72ac58d599e6e1080251b1ac45a521b33c08d7d129828a4e82a7095e9f93e53"
      },
      {
        "id": "",
        "name": "9572312a12605c6a6ea6447af6fc063f4196aeba523ed38ce2c5ff51c33d4831"
      },
      {
        "id": "",
        "name": "512a83f1a6c404cb0ba679c7a2f3aa782bb5e17840d31a034de233f7500a6cb9"
      },
      {
        "id": "",
        "name": "142c6a4c7e9efbf6f3176df3ff218449bb4f7b2a69d60060e6339f1c3cc95d93"
      },
      {
        "id": "",
        "name": "006e5fe0c01712391c54319a9d1579d7208f3cfa9f49fe56a14d93f0d0e8928b"
      },
      {
        "id": "",
        "name": "e21396bf5f9936310b4f53273db330a9620d78c1c744277b0e9126f0afdbc29d"
      },
      {
        "id": "",
        "name": "9ce32ce5e2b70fec7f749e7868d89a4e3e739fed9c75cd6c4ec6eafde4c3711a"
      },
      {
        "id": "",
        "name": "613068422c214b944c7b2e3fb60412ed99d35c9e18d53d45b16965c5a36f734a"
      }
    ],
    "intrusion_sets": [
      {
        "id": "30cbcbf2-21bc-489d-8705-845e05a87de5",
        "name": "SideWinder",
        "slug": "sidewinder"
      }
    ],
    "attack_patterns": [
      {
        "id": "12f8e9b3-4b72-45d2-9989-f1171e6417ef",
        "name": "T1221"
      },
      {
        "id": "3bcbd7d0-6c9a-4d9b-8c71-ae338737bea1",
        "name": "T1480"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "67c697ce-a6cc-475f-9bee-e14c1bef7067",
        "name": "T1047"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2017-11882"
      },
      {
        "id": "",
        "name": "CVE-2017-0199"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Maldives"
      },
      {
        "id": "",
        "name": "Egypt"
      },
      {
        "id": "",
        "name": "Myanmar"
      },
      {
        "id": "",
        "name": "Sri Lanka"
      },
      {
        "id": "",
        "name": "Nepal"
      },
      {
        "id": "",
        "name": "Bangladesh"
      },
      {
        "id": "",
        "name": "Pakistan"
      }
    ]
  },
  "external_refs": [
    "https://blogs.blackberry.com/en/2024/07/sidewinder-targets-ports-and-maritime-facilities-in-the-mediterranean-sea",
    "https://otx.alienvault.com/pulse/66a9093cc37e48ed693820e8"
  ]
}