APT Gang Sidewinder Goes On Two Year Attack Spree Across Asia

Black Hat Asia The advanced persistent threat gang known as SideWinder has gone on an attack spree in the last two years, conducting almost 1,000 raids and deploying increasingly sophisticated attack methods.

Noushin Shaba, a senior security researcher on Kaspersky’s global research and analysis team, today told the Black Hat Asia conference that SideWinder mostly targets military and law enforcement agencies in Pakistan, Bangladesh and other South Asian nations. The gang has previously been associated with Indian actors, but Shaba said previous indicators that led to that attribution have disappeared – she was not confident tying the group to any nation.

Shaba was, however, happy to declare that SideWinder has become one of the planet’s most prolific attackers. Why the gang has stepped up its activities is not known. The Kaspersky researcher opined that perhaps its resources have increased, by means unknown.

Evidence of the group’s deeper pockets comes from both the expanded scope of its activities and the increasing sophistication of its preferred malware. Shaba said that in late 2021, the group deployed new obfuscation techniques for the Javascript it drops into .RTF files, .LNK files, and Open Office documents. Kaspersky has observed unique encryption keys deployed across over 1,000 malware samples sourced from the group.

SideWinder’s operatives even ran two versions of its obfuscation techniques over several months, and appear to have migrated from an older and less stealthy version to its current malware.

The group uses a four-stage process to attack targets, with the file types mentioned usually the first step as they deploy scripts that contact a network of servers hosted at over 400 domains. The group uses that network to install backdoors and exfiltrate data.

Happily, defending against the group’s activities starts with basic tactics such as keeping software patched, as SideWinder targets unpatched productivity software.

But patching efforts may not defeat all comers – Shaba said SideWinder has been so successful it has inspired an imitator named SideCopy that uses some of its techniques and code.

SideWinder may have earned the flattery of an imitator through its longevity. Security researchers believe it has been active for a decade – an impressive lifespan in a notoriously tough “industry”. ®

READ MORE HERE