Threat Intelligence Tarot
swords · 10
India (suspected)
G0121★★★★★
risk 3/5
✦ The Viper ✦
SideWinder
Rattlesnake · APT-C-17 · T-APT-04
Pakistan militaryNepal governmentSri LankaBangladeshAfghanistan
Active since ~2012 · Pakistan military intelligence, Nepal and Sri Lanka surveillance, South Asian geopolitical monitoring
It moves low and fast, striking along the fault lines of South Asian geopolitics. Pakistan's military networks feel it every cycle; Nepal's government ministries know its lures by sight. The Viper is not subtle - it is prolific.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆1,000+ cyberattacks documented in three years across South Asia
- ◆Pakistan Air Force and Navy targeting
- ◆Nepal and Sri Lanka governmental intrusions
- ◆JavaScript-based fileless execution chain deployment
Defenses
- ▸Disable JavaScript execution from email-sourced filesCIS Control 9 ↗
- ▸Application allowlisting on government endpointsCIS Control 2 ↗
- ▸Geopolitically-aware threat intelligence subscriptionsNIST CSF: ID.RA ↗
- ▸Monitoring for LOLBin and living-off-the-land techniquesNIST CSF: DE.CM ↗
Reversed: Their Weakness
SideWinder's volume-over-sophistication approach creates a large forensic footprint. Its infrastructure reuse and consistent lure themes have made it one of the most-documented South Asian threat actors, providing defenders with extensive indicator libraries.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.