---
title: Sidewinder Using New Tools to Target Maritime and Nuclear Sectors
description: SideWinder, an APT group thought to be of Indian nexus, was recently observed using new TTPs and expanding their targeting to include entities in the maritime and nuclear energy sectors.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Sidewinder Using New Tools to Target Maritime and Nuclear Sectors](https://blog.polyswarm.io/sidewinder-using-new-tools-to-target-maritime-and-nuclear-sectors)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Mar 14, 2025 7:14:11 PM

**Verticals Targeted:** Maritime, Nuclear

## **Executive Summary**

## SideWinder, an APT group thought to be of Indian nexus, was recently observed using new TTPs and expanding their targeting to include entities in the maritime and nuclear energy sectors.

**Key Takeaways**

- SideWinder was recently observed using new TTPs and expanding their targeting to include entities in the maritime and nuclear energy sectors.
- The threat actors used a targeted phishing campaign to deliver StealerBot, a custom-built espionage toolkit. 
- Based on SideWinder’s expanded targeting, use of new TTPs, and their ability to quickly adapt to the threat landscape, PolySwarm analysts consider SideWinder to be an evolving threat. 

**The Campaign**

### SideWinder, active since 2012, has historically targeted government, military, and diplomatic entities, predominantly in South and Southeast Asia. Recent intelligence indicates an expansion of their operational focus to include maritime and nuclear energy sectors. The group was also observed using new TTPs in this campaign. Kaspersky Securelist [reported](https://securelist.com/sidewinder-apt-updates-its-toolset-and-targets-nuclear-sector/115847/) on this activity. 

SideWinder’s infection chain continues to rely on spear-phishing emails as the primary vector. These campaigns deploy DOCX attachments, utilizing remote template injection to retrieve an RTF file from attacker-controlled infrastructure. The RTF exploits CVE-2017-11882, a vulnerability in Microsoft Office’s Equation Editor, to execute shellcode that deploys a modular component, dubbed “Backdoor Loader” by Kaspersky. This loader facilitates the delivery of StealerBot, a custom-built espionage toolkit designed for data exfiltration. The phishing lures are meticulously crafted, often masquerading as documents related to nuclear power infrastructure or maritime operations, aligning with the targeted entities.

Geographic and sectoral expansion is evident. In 2025, attack clusters were observed in Djibouti, followed by a shift to Egypt, with additional activity targeting nuclear-related organizations in South Asia. The group has also targeted logistics and maritime firms across Southeast Asia, alongside diplomatic targets in Afghanistan, Algeria, Bulgaria, and elsewhere. Affected countries include Bangladesh, Cambodia, Vietnam, and others, with telecommunications, IT services, and hospitality sectors also impacted. This broadening scope underscores SideWinder’s intent to compromise critical infrastructure and supply chains.

SideWinder’s recent activity also demonstrates sophistication and agility in toolset maintenance. The group actively monitors detection rates, generating updated malware variants within five hours of identification by security solutions. While StealerBot’s core functionality remains stable, the supporting loaders undergo frequent modifications to circumvent behavioral analysis and signature-based detection. Continued reliance on CVE-2017-11882 suggests a pragmatic approach, leveraging unpatched systems rather than investing in 0-day exploits.

**Who is SideWinder? **

SideWinder, also known as APT-C-17, Rattlesnake, and T-APT-04, is an APT group that has been active since at least 2012. While industry researchers are uncertain of their origin, the group is thought to be of Indian nexus. Verticals targeted by Sidewinder include government, defense, logistics, financial, education, telecommunications, and ONG. The group has targeted entities in multiple countries, including Bangladesh, Djibouti, Jordan, Malaysia, the Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey and the UAE. However, their primary focus seems to be entities in Pakistan. Based on SideWinder’s expanded targeting, use of new TTPs, and their ability to quickly adapt to the threat landscape, PolySwarm analysts consider SideWinder to be an evolving threat. 

## **IOCs**

PolySwarm has multiple samples associated with this campaign.

 

[865f5b3b1ee94d89ad9a9840f49a17d477cddfc3742c5ef78d77a6027ad1caa5](https://polyswarm.network/scan/results/file/865f5b3b1ee94d89ad9a9840f49a17d477cddfc3742c5ef78d77a6027ad1caa5)

[fa95fadc73e5617305a6b71f77e9d255d14402650075107f2272f131d3cf7b00](https://polyswarm.network/scan/results/file/fa95fadc73e5617305a6b71f77e9d255d14402650075107f2272f131d3cf7b00)

[aacaf712cf67176f159657be2fbd0fce018aa03b890cb1616b146eddb1de73be](https://polyswarm.network/scan/results/file/aacaf712cf67176f159657be2fbd0fce018aa03b890cb1616b146eddb1de73be)

[512a83f1a6c404cb0ba679c7a2f3aa782bb5e17840d31a034de233f7500a6cb9](https://polyswarm.network/scan/results/file/512a83f1a6c404cb0ba679c7a2f3aa782bb5e17840d31a034de233f7500a6cb9)

[57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce](https://polyswarm.network/scan/results/file/57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce)

76daea942654d8175f642696fc758b03767db14ca5dda9994797a3f95a34294a

30735312101e60a697f161abba62ca359eed240d2e612b1ff7bed6523b28730d

5740947bb9267e1be8281edc31b3fb2d57a71d2c96a47eeeaa6482c0927aa6a4

 

You can use the following CLI command to search for all associated samples in our portal:

**$ polyswarm link list -t SideWinder**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) ***|* **[Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/sidewinder-using-new-tools-to-target-maritime-and-nuclear-sectors)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2025-03-14T19:14:11.768Z",
  "datePublished" : "2025-03-14T19:14:11Z",
  "headline" : "Sidewinder Using New Tools to Target Maritime and Nuclear Sectors",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/SIDEWINDER.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/sidewinder-using-new-tools-to-target-maritime-and-nuclear-sectors",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```