← All actors Recent activity

Sidewinder G0121

SIDEWINDER · GroupA21 · apt-04 · apt-c-24 · apt-q-39 · apt-q-42 · babyelephant · ghostchat · hardcore nationalist · nh2 · rattlesnake · sloppylemming · ta399

Indicators
3,768
Source reports
1,096
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-08-07
20182026

Overview 3,768 indicators

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

domain3,640G0121-domain.txt
ipv450G0121.json
url41G0121.json
url_path37G0121.json

Techniques 30 ATT&CK

Open in ATT&CK Navigator → or download the layer (30 techniques, layer 4.5)

Software 1

Principal sources 1,096 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 3,768 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

Showing the 300 most recent of 3,768. Complete: G0121.json.

  1. 5 domainthis year

    x.com/joe4security/status/2085384961570349091 · joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e… · virustotal.com/gui/file/3b9432019a80a62fe6760a65f26777… · virustotal.com/gui/file/6b85e9c7dd33416a096e377303d82a…

    defense-housing-authority.vagued.live
    msofficeupdate.vagued.live
    msofficeupdator.vagued.live
    uy.vagued.live
    vagued.live

  2. 3 domainthis year

    x.com/volrant136/status/2085410874051981755

    infomofa.workers.dev
    mail-navy-lk.up.railway.app
    misty-pond-6b85.infomofa.workers.dev

  3. 4 domainthis year

    x.com/blackorbird/status/2084940847863509476 · mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg

    apps-sco-gov-pk.workers.dev
    gov-pk.workers.dev
    itsupport.apps-sco-gov-pk.workers.dev
    webmail-pnra.gov-pk.workers.dev

  4. 1 domainthis year

    x.com/phatomcandle/status/2077737009569808478 · x.com/volrant136/status/2083246886262313189 · virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5…

    www-nea-gov-cn.fetchdrives.info

  5. 1 domainthis year

    x.com/volrant136/status/1923061758643597787

    pmdc.gov.pk-hq.cc

  6. 12 domainthis year

    x.com/volrant136/status/2081805669175370115

    pkmpunjabcode.com
    spfc-punjab-gov-pk.online
    spfc-punjab-govpk.xyz
    spfc-punjab-pk.cc
    spfc-punjabgov-pk.co
    spfc-punjabgov-pk.com
    spfc.pk
    spfcpkm.online
    spfcpungov.site
    spfcpunjab-gov-pk.com
    spfcpunjabgov.com
    spfcpunjabsgovs.pk

  7. 1 domainthis year

    x.com/volrant136/status/2080669471878819889

    mail-fisheries-gov-bd.netlify.app

  8. 3 domainthis year

    x.com/phatomcandle/status/2077737009569808478 · x.com/volrant136/status/2083246886262313189 · virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5…

    9t.fetchdrives.info
    fetchdrives.info
    mofa-gov-bd.fetchdrives.info

  9. 1 domainthis year

    x.com/skocherhan/status/2027484078132379889

    visa-nadra-gov-pk.info

  10. 9 domainthis year

    x.com/suyog41/status/2075572390315311333 · virustotal.com/gui/file/372226c831de35186e1c96ec28c9ca… · virustotal.com/gui/file/5ef25d162827195f2fbdc80fd5c6d1…

    bdnavy.download-msoffice.com
    cabinet-division-gov-pk.download-msoffice.com
    ceh.download-msoffice.com
    docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com
    download-msoffice.com
    mm.download-msoffice.com
    portmin.download-msoffice.com
    training.docx2a2e3e78e76bcc759905da3f1532a4b8c2word.download-msoffice.com
    word.download-msoffice.com

  11. 1 domainthis year

    x.com/volrant136/status/2076012175685287991

    mail-bcc-gov-bd.vercel.app

  12. 3 domainthis year

    x.com/volrant136/status/2073667741438103962 · x.com/volrant136/status/2073668614679650761

    ep-mocha.vercel.app
    epyi-zimbat-five.vercel.app
    uptownhigh.live

  13. 1 domainthis year

    x.com/volrant136/status/2073059201346408940

    wmail-zim-gov-rj-se-sp-br-63330a.netlify.app

  14. 1 domainthis year

    x.com/volrant136/status/2028050650110554502 · x.com/__0XYC__/status/2072904128695800308

    tight-lake-webuploader.malik-jaani786.workers.dev

  15. 1 domainthis year

    x.com/volrant136/status/2068637244039258552

    mail-bfsa-gov-bd.netlify.app

  16. 4 domainthis year

    x.com/volrant136/status/2066232019890426173 · virustotal.com/gui/file/f5a7890fd09909711cd9aed1614f8f…

    min-pk.com
    mofa-gov-np.min-pk.com
    qa.min-pk.com
    qh.min-pk.com

  17. 10 domainthis year

    x.com/volrant136/status/2064713040029991309

    2672ewr5403894534fgdgfd5907e44fdfgdfg67088gdfgfd90e2cbd8b6.pages.dev
    9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d1.pages.dev
    9af72fg4jg75hg8jg9dfghhfgdh5666k41706769d32bf1f766cdec1d11.pages.dev
    dnsvay8faydj3f79dje9djr02j101c4atg3c3acdd2a06ca2fb183cf995.pages.dev
    mail-defence-lk-webmail-imp-view-php-actiob-ri5it-kgfi5kg9.pages.dev
    mail-navy-lk-4326er48fdu49fgu49fgj549fj349fdj3490fdjk390df.pages.dev
    mail-navy-lk-login.pages.dev
    sdf-sdgyhsdfg-sdfglksdjh-sdglkjsdglhks-gsdflsdfhhsdfgjklls.pages.dev
    sdfsdf-tfghfghf546rty6ytuuyjgutyjghj-rtfytr54fghf-fghfg-fg.pages.dev
    sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev

  18. 3 domainthis year

    x.com/skocherhan/status/2027484078132379889

    pk-cc.com
    pk-qrs.online
    visa.nadra.gov.pk-cc.com

  19. 2 ipv4this year

    linkedin.com/posts/smica83_sidewinder-rattlesnake-ma… · virustotal.com/gui/file/04016d3ac1b30375de773a8fd63a4d… · virustotal.com/gui/file/3b294866be0b9d298121df7fbb2709… · virustotal.com/gui/file/e9f44c4e4239b676c8c9afd05edf7c…

    5.252.178.27:443
    5.252.178.27:9889

  20. 7 domainthis year

    x.com/volrant136/status/2056744757330665683 · virustotal.com/gui/ip-address/83.243.121.239/relations

    interior-ministry.com
    mofa-gov-bd.interior-ministry.com
    moha-gov-np.interior-ministry.com
    ol.interior-ministry.com
    pubad-gov-lk.interior-ministry.com
    www-ndma-gov-pk.interior-ministry.com
    www-sbp-org-pk.interior-ministry.com

  21. 1 domainthis year

    x.com/volrant136/status/1938848055022833806 · x.com/volrant136/status/2056766835962323257

    interiorgovpk.life

  22. 2 domainthis year

    x.com/volrant136/status/2056077509901574493 · virustotal.com/gui/file/3003f4084df2f5ef9cdd896abc099f… · virustotal.com/gui/file/a03677e263bad0c2ea6ae319c1b0b9…

    interior-gov-pk.direct880.net
    moha-gov-np.direct880.net

  23. 5 domainthis year

    x.com/volrant136/status/2055309731229507629

    dumping-open-burning-of-hazardous-waste.zeabur.app
    iran-war-or-deal.zeabur.app
    mail-ideaspakistan-gov-pk.zeabur.app
    minutes-of-meeting.zeabur.app
    zimbramail-nyatel-com.up.railway.app

  24. 6 domain, 1 url_paththis year

    x.com/__0XYC__/status/2054792675887382660 · x.com/__0XYC__/status/2054793748106657829 · virustotal.com/gui/file/b9a5a187f850885bf7e9de5c1f9574…

    domaincloudforme.top
    domaindocs.files-windows.top
    domainfiles-windows.top
    domainntc-firewall.safeurl-content.online
    domainpakistan-server-auth0.cloudforme.top
    domainsafeurl-content.online
    url_path/opx/mailflair/r/EZ6n6FMhSh

  25. 4 domainthis year

    x.com/malwrhunterteam/status/2054831494347063… · virustotal.com/gui/file/34074546f23b48d31d368b2b1c0c3f… · virustotal.com/gui/file/9ae756a44c87dde511f11b521c7643… · virustotal.com/gui/file/d163ef058710925ef5ea2be66df52d…

    2r.nrtcpk-net.com
    circular.nrtcpk-net.com
    erty.nrtcpk-net.com
    nrtcpk-net.com

  26. 2 domainthis year

    x.com/skocherhan/status/2027484078132379889

    ee-visa.com
    nadra-gov.ee-visa.com

  27. 8 domainthis year

    x.com/Cyberteam008/status/2048596656141340906 · virustotal.com/gui/file/e032080c5afeb99bd8bd87e3f68d2b… · virustotal.com/gui/file/159c47db6c9a162c47167ff4d9ebb8…

    direct880.net
    geneva-mofa-gov-bd.direct880.net
    mofa-go-np.direct880.net
    mofa-gov-np.direct880.net
    pakun-org.direct880.net
    wg.direct880.net
    www-fbr-gov-pk.direct880.net
    www-securitycouncilreport-org.direct880.net

  28. 1 domainthis year

    x.com/volrant136/status/2048431910871875851

    zimbra-nyatel-production.up.railway.app

  29. 1 domainthis year

    x.com/volrant136/status/2048054426078724126

    webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev

  30. 1 domain, 1 ipv4this year

    x.com/Thisism23567356/status/2047237888799092… · virustotal.com/gui/file/ae3348414926ec22db313ccd61b0d7… · virustotal.com/gui/file/d375ad74e3f3994f919a68f97d082f…

    domaindriveattachment-mofa.com
    ipv438.60.235.109:9876

  31. 42 domainthis year

    x.com/volrant136/status/2046603826296234102

    cabinet.gov.bd.pk-mailgov.com
    cbsl.lk.pk-mailgov.com
    commerce.gov.pk.pk-mailgov.com
    control.pk-mailgov.com
    cpj.org.pk-mailgov.com
    dmerpccc.gov.pk.gmail.com.pk-mailgov.com
    estabiishment.gov.pk-mailgov.com
    fbr.gov.pk-mailgov.com
    fpsc.gov.pk-mailgov.com
    gmail.com.pk-mailgov.com
    gov.pk-mailgov.com
    gunaso.pk-mailgov.com
    hotmail.pk-mailgov.com
    info.pk-mailgov.com
    info2.pk-mailgov.com
    interior.gov.pk-mailgov.com
    mha.gov.bd.pk-mailgov.com
    mishal.com.pk-mailgov.com
    mo.treasury.gov.lk.pk-mailgov.com
    mod.gov.bd.pk-mailgov.com
    mof.gov.np.pk-mailgov.com
    mofa.gov.bd.pk-mailgov.com
    moha.gov.bd.pk-mailgov.com
    moha.gov.np.pk-mailgov.com
    moib.gov.pk-mailgov.com
    ndma.gov.pk-mailgov.com
    org.pk-mailgov.com
    osacadmin.pk-mailgov.com
    pakun.org.pk-mailgov.com
    pk-mailgov.com
    pk.gmail.com.pk-mailgov.com
    pk.pk-mailgov.com
    pubad.gov.lk.pk-mailgov.com
    reliefweb.int.pk-mailgov.com
    securitycouncilreport.org.pk-mailgov.com
    sltnet.lk.pk-mailgov.com
    state.gov.pk-mailgov.com
    treasury.gov.lk.pk-mailgov.com
    un.org.pk-mailgov.com
    webdisk.pk-mailgov.com
    webmail.pk-mailgov.com
    whm.pk-mailgov.com

  32. 6 domainthis year

    virustotal.com/gui/ip-address/89.116.133.247/relations

    apostille-mofa-gov-pk-verify-attestation.cerapostille.com
    apostille-mofa-gov-pk-verify-attestation.encodertechs.com
    apostillemofag0v-pk.storeaone.com
    appostile-mofa-pk.storeaone.com
    appostille-mofa-gov-pk-attestation.storeaone.com
    appostille-mofa-gov.storeaone.com

  33. 2 domainthis year

    intel.breakglass.tech/post/sidewinder-z2fa-lts-moincox-bangla…

    preview-mail-from-mofa-gov-pk-user-com-center.malik-jaani786.workers.dev
    zimramail-nayatel.girlfriendparty42.workers.dev

  34. 1 domainthis year

    x.com/volrant136/status/2046241063380390343

    twilight-violet-55a5.malik-jaani786.workers.dev

  35. 3 domainthis year

    x.com/__0XYC__/status/2042075173915127858 · x.com/SinghSoodeep/status/2043571382601289736 · virustotal.com/gui/file/492a46f495a17a0c5d7e59cf362f3f…

    mail-svr.co
    mofa-gov-bd.mail-svr.co
    www-unocha-org.mail-svr.co

  36. 1 domainthis year

    x.com/volrant136/status/2040459381930877404

    contract-agreement-with-staff.zeabur.app

  37. 2 domainthis year

    x.com/skocherhan/status/2027484078132379889

    blog.fbmastery.com
    fbmastery.com

  38. 1 domainthis year

    x.com/volrant136/status/2039761718969315508

    zimbramail-nayatel-com.zeabur.app

  39. 3 domainthis year

    x.com/__0XYC__/status/2039538772090753351

    estabiishment.gov.ministry-gov.org
    gov.ministry-gov.org
    ministry-gov.org

  40. 1 domainthis year

    x.com/skocherhan/status/2027484078132379889

    evisa-nadra-govpak.com

  41. 5 domainthis year

    x.com/skocherhan/status/2027484078132379889

    gov.pk-cam.online
    gov.pk.onev.online
    gov.qrpk.info
    pk-cam.online
    visa.nadra.gov.pk-cam.online

  42. 1 domainthis year

    x.com/AndreGironda/status/1981785066515968447 · cybersecuritynews.com/sidewinder-hacking-group-uses-clickonce… · virustotal.com/gui/file/99ed9f44a02a3549d60c58233f7936… · virustotal.com/gui/file/93ebcdc6bee559d9c61f484dd521c9…

    dp.islamic-finder.org

  43. 6 domainthis year

    x.com/SinghSoodeep/status/2035992239235903862 · virustotal.com/gui/file/4d11d087acbf9573e3f850a99f5bb6…

    cabinet-gov-bd.donwloaad-file.com
    df.donwloaad-file.com
    donwloaad-file.com
    fbr-gov-pk.donwloaad-file.com
    pubad-gov-lk.donwloaad-file.com
    www-fbr-gov-pk.donwloaad-file.com

  44. 2 domainthis year

    x.com/volrant136/status/2035748336410759648

    fbr-g0v.pk
    ndmagovpk.com

  45. 2 domainthis year

    x.com/volrant136/status/2035385952529522976

    cabinet-gov-pk.mora-govpk.co
    mora-govpk.co

  46. 3 domainthis year

    x.com/skocherhan/status/2027484078132379889

    pk-ev.online
    pk-o.xyz
    visa.nadra.gov.pk-o.xyz

  47. 1 domainthis year

    x.com/volrant136/status/2034639901853970679

    bold-bonus-1d3b.malik-jaani786.workers.dev

  48. 1 domainthis year

    x.com/volrant136/status/2028050650110554502 · x.com/__0XYC__/status/2072904128695800308 · x.com/volrant136/status/2034639901853970679

    malik-jaani786.workers.dev

  49. 15 domainthis year

    x.com/FatzQatz/status/2034236872076231108

    ambpoint.vip
    blueoceancode.com
    guosapp.vip
    guotoujgvip.vip
    gygaxf.com
    hkunionpoy.vip
    jobfreeeco.it.com
    line-wqeyoiua.top
    mitgiied.vip
    wps-hakjgyu.top
    wps-yoiuzuiof.top
    xdappxz.vip
    xdlxweb.vip
    yayoi.it.com
    zhenpinxuanji.vip

  50. 3 domainthis year

    x.com/skocherhan/status/2027484078132379889

    qrpk.info
    visa.nadra.gov-pk.info
    visa.nadra.gov.qrpk.info

  51. 2 domainthis year

    x.com/volrant136/status/2033574016154226898

    girlfriendparty42.workers.dev
    royal-field-9144.girlfriendparty42.workers.dev

  52. 1 domainthis year

    x.com/volrant136/status/2033226839788060973

    freshg-dgprocur2028200-ou4zqmub.leapcell.dev

  53. 1 domainthis year

    x.com/skocherhan/status/2027484078132379889

    onev.online

  54. 2 domainthis year

    x.com/volrant136/status/2032833539201540166

    dekl-dgprocur2028200-ljakefli.leapcell.dev
    mail-hit-gov.leapcell.app

  55. 4 domainthis year

    x.com/RedDrip7/status/2032290347527913562 · virustotal.com/gui/file/67c341e187ddfcd5a4a7df8743ae82… · virustotal.com/gui/file/e5474cad56d35160c83378e6719f7c…

    bahria-edu.workers.dev
    cc-cvbs-sco.workers.dev
    cms.bahria-edu.workers.dev
    support.cc-cvbs-sco.workers.dev

  56. 2 domainthis year

    x.com/skocherhan/status/2027484078132379889

    com-e-visa.online
    visa.nadra.gov.pk.com-e-visa.online

  57. 1 domainthis year

    x.com/volrant136/status/2032133065666089160

    zimbramail-nayatel.leapcell.app

  58. 11 domainthis year

    x.com/wa1Ile/status/2031612431856971936 · virustotal.com/gui/file/dcca21d91e3f261f998d7caa78660a…

    ankara-mofa-gov-bd.fia-g0v.net
    cabinet-gov-bd.fia-g0v.net
    fia-g0v.net
    mofa-gov-np.fia-g0v.net
    mofa-gov-pk.fia-g0v.net
    moha-portal-gov-bd.fia-g0v.net
    pubad-gov-ik.fia-g0v.net
    pubad-gov-lk.fia-g0v.net
    www-cbsl-gov-lk.fia-g0v.net
    www-commerce-gov-pk.fia-g0v.net
    www-establishment-gov-pk.fia-g0v.net

  59. 2 domainthis year

    x.com/skocherhan/status/2027484078132379889

    visa.nadra-gov.click
    visa.nadra.gov.pk-ev.online

  60. 3 domainthis year

    arcticwolf.com/resources/blog/sloppylemming-deploys-bu…

    bangladesh-islamic-baank.workers.dev
    info.bangladesh-islamic-baank.workers.dev
    ov-pk.workers.dev

  61. 3 domainthis year

    x.com/volrant136/status/2028050650110554502 · x.com/__0XYC__/status/2072904128695800308

    download-secure-app-from-icloud.malik-jaani786.workers.dev
    hit-view-message-preview.malik-jaani786.workers.dev
    modp-view-full-message.malik-jaani786.workers.dev

  62. 22 domainthis year

    x.com/skocherhan/status/2027484078132379889

    gov-pak.com
    gove.pw
    gvo-pk.cc
    lubeleaf.com
    nadra-gov.online
    nadra-gov.pt
    nadra.gove.pw
    nadra.gvo-pk.cc
    pakvisa.online
    shafaftech.com
    visa-nadra-gov-pk.desynt.com
    visa-nadra-gov-pk.lubeleaf.com
    visa-nadra-gov-pk.pages.dev
    visa-nadra-gov-pk.shafaftech.com
    visa-nadra-gov-pk.xo.je
    visa.nadra-gov.online
    visa.nadra-gov.pt
    visa.nadra.gov-pak.com
    visa.nadra.gov.pk.pakvisa.online
    visa.nadra.gov.pk.rdpip.com
    visa.nadra.gove.pw
    visa.nadra.gvo-pk.cc

  63. 2 domainthis year

    x.com/__0XYC__/status/2026971764769665277 · virustotal.com/gui/file/795ea82a7aa424f6d54d975a44d1c6…

    adobe.updatepdf.workers.dev
    updatepdf.workers.dev

  64. 1 domainthis year

    x.com/volrant136/status/2024478284982210852

    mail-navy-lk-43897fyi78945tr78945uio89045iuort89045prt054k.pages.dev

  65. 2 domainthis year

    x.com/suyog41/status/2023736857771827313 · virustotal.com/gui/file/f0ee184cdc7ba2a87a669462942f11…

    cdn-pkcert-gov-pk.pages.dev
    nrtc-com-pk.pages.dev

  66. 1 domainthis year

    virustotal.com/gui/ip-address/172.67.166.115/relations

    pkcert-gov-pk.workers.dev

  67. 5 domainthis year

    x.com/volrant136/status/2023422149449699599

    234rewr44dfs34sdf43454353fd4ffg345rr4.netlify.app
    435fdgfd-fgh675gh56jh-65jhg65ghjytu65.netlify.app
    9af72fg4jg75hg8jg94kg94k9fk390gk4170674tr69bf1f766cdec1d11.pages.dev
    mail-pmo-gov-lk3u3i495ui3jkdf9d549fgkj45fg94jdfg904j439g.pages.dev
    slservices-lk.com

  68. 1 domainthis year

    x.com/volrant136/status/2022993609352741257

    navy-pk-dils-maint213-ifwcnxl4.leapcell.dev

  69. 5 domainthis year

    x.com/__0XYC__/status/2022530597097271436 · x.com/volrant136/status/2022616294122508555

    download-doc.com
    mail-pk.com
    mails-pk.net
    pc-gov-pk.download-doc.com
    www-cbsl-gov-lk.download-doc.com

  70. 1 domainthis year

    x.com/volrant136/status/2021636487281045747

    mail-ntc-net-pk-zimbra-dils-maint213-2q1ntcqz.leapcell.dev

  71. 11 domainthis year

    x.com/volrant136/status/2021636487281045747

    www-ccdi-gov-cn.hkbmwzone.com
    www-chinaneast-gov-cn.videoem.com
    www-creditjx-gov-cn.aaaqb.com
    www-enfotss-gov-ao.pages.dev
    www-hernandarias-gov-py.pages.dev
    www-shshjs-gov-cn.videoem.com
    www-tic-gov-tl.outlookowa.com
    www-tic-gov-tl.selectpaw.com
    www-tjlsj-gov-cn.syyjc.net
    www-toki-gov-tr.sa.com
    www-ymbq-gov-cn.drron.net

  72. 5 domainthis year

    x.com/__0XYC__/status/2021430578197995793

    establishment.mails-pk.com
    filenesthub.org
    mails-pk.com
    pubad-gov-lk.filenesthub.org
    www-finance-gov-pk.filenesthub.org

  73. 11 domainthis year

    x.com/volrant136/status/2020360851639922927

    bgmea-com-bd.loadpath.net
    depo-gov-pk.loadpath.net
    g20-org-za.loadpath.net
    kashmirawareness.loadpath.net
    loadpath.net

    · 6 more in this batch, in the JSON

Further reading 1,100

1,060 more, and the report behind every indicator, in G0121.json.