State-Sponsored Sidewinder Hacker Group’s Covert Attack Infrastructure Uncovered

Cybersecurity researchers have unearthed previously undocumented attack infrastructure used by the prolific state-sponsored group SideWinder to strike entities located in Pakistan and China.

This comprises a network of 55 domains and IP addresses used by the threat actor, cybersecurity companies Group-IB and Bridewell said in a joint report shared with The Hacker News.

“The identified phishing domains mimic various organizations in the news, government, telecommunications, and financial sectors,” researchers Nikita Rostovtsev, Joshua Penny, and Yashraj Solanki said.

SideWinder has been known to be active since at least 2012, with attack chains primarily leveraging spear-phishing as an intrusion mechanism to obtain a foothold into targeted environments.

The target range of the group is widely believed to be associated with Indian espionage interests. The most frequently attacked nations include Pakistan, China, Sri Lanka, Afghanistan, Bangladesh, Myanmar, the Philippines, Qatar, and Singapore.

images from Hacker News