← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
SideWinder targets the maritime and nuclear sectors with an updated toolset
Last year, we published an article about SideWinder, a highly prolific APT group whose primary targets have been military and government entities in Pakistan, Sri Lanka, China, and Nepal. In it, we described activities that had mostly happened in the first half of the year. We tried to draw attention to the group, which was aggressively extending its activities beyond their typical targets, infecting government entities, logistics companies and maritime infrastructures in South and Southeast Asia, the Middle East, and Africa. We also shared further information about SideWinder’s post-exploitation activities and described a new sophisticated implant designed specifically for espionage.
Indicators of Compromise (70)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| CVE | CVE-2017-11882 | — | 2025-03-11 | |
| FileHash-MD5 | 0216ffc6fb679bdf4ea6ee7051213c1e | — | 2025-03-11 | |
| FileHash-MD5 | 313f9bbe6dac3edc09fe9ac081950673 | — | 2025-03-11 | |
| FileHash-MD5 | 3d9961991e7ae6ad2bae09c475a1bce8 | — | 2025-03-11 | |
| FileHash-MD5 | 433480f7d8642076a8b3793948da5efe | — | 2025-03-11 | |
| FileHash-MD5 | 872c2ddf6467b1220ee83dca0e118214 | — | 2025-03-11 | |
| FileHash-MD5 | a694ccdb82b061c26c35f612d68ed1c2 | — | 2025-03-11 | |
| FileHash-MD5 | bd8043127abe3f5cfa61bd2174f54c60 | — | 2025-03-11 | |
| FileHash-MD5 | d36a67468d01c4cb789cd6794fb8bc70 | — | 2025-03-11 | |
| FileHash-MD5 | e0bce049c71bc81afe172cd30be4d2b7 | — | 2025-03-11 | |
| FileHash-MD5 | e9726519487ba9e4e5589a8a5ec2f933 | — | 2025-03-11 | |
| FileHash-MD5 | f42ba43f7328cbc9ce85b2482809ff1c | — | 2025-03-11 | |
| FileHash-SHA1 | 013ead0c89431a69bbe7e7b39a1095dc4faea456 | SHA1 of f42ba43f7328cbc9ce85b2482809ff1c | 2025-03-11 | |
| FileHash-SHA1 | 334f3313b03bbfeaae6fc7a0257d4fd8cb6dd751 | SHA1 of a694ccdb82b061c26c35f612d68ed1c2 | 2025-03-11 | |
| FileHash-SHA1 | 5a12b7f4214ac1f79f2b613fb482e58701dfaaa6 | SHA1 of e9726519487ba9e4e5589a8a5ec2f933 | 2025-03-11 | |
| FileHash-SHA1 | 639ccf8e2e0643b0d93db9ebf508ac0f1836cccd | SHA1 of bd8043127abe3f5cfa61bd2174f54c60 | 2025-03-11 | |
| FileHash-SHA1 | 69069ac1c9bdc97ff1d060d4fc9f42b91c25669b | SHA1 of 3d9961991e7ae6ad2bae09c475a1bce8 | 2025-03-11 | |
| FileHash-SHA1 | 71daaff7ba2b92e69a5e94c0efa2f5a097bcd65c | SHA1 of 0216ffc6fb679bdf4ea6ee7051213c1e | 2025-03-11 | |
| FileHash-SHA1 | 81d00923f2e9e0bae7c51ffbcb66409dd9a3da05 | SHA1 of 433480f7d8642076a8b3793948da5efe | 2025-03-11 | |
| FileHash-SHA1 | 84b4b2705018e38253796cd3f84ee68694d9b9c0 | SHA1 of d36a67468d01c4cb789cd6794fb8bc70 | 2025-03-11 | |
| FileHash-SHA1 | 96cafccda39d2dd06e22b33ca37504405439c23d | SHA1 of 313f9bbe6dac3edc09fe9ac081950673 | 2025-03-11 | |
| FileHash-SHA1 | dbc5756895b6585527bd6ebc4411ea6a4a6e2886 | SHA1 of 872c2ddf6467b1220ee83dca0e118214 | 2025-03-11 | |
| FileHash-SHA256 | 30735312101e60a697f161abba62ca359eed240d2e612b1ff7bed6523b28730d | SHA256 of f42ba43f7328cbc9ce85b2482809ff1c | 2025-03-11 | |
| FileHash-SHA256 | 44ff1117bb0167f85d599236892deede636c358df3d8908582a6ce6a48070bd4 | SHA256 of 433480f7d8642076a8b3793948da5efe | 2025-03-11 | |
| FileHash-SHA256 | 5740947bb9267e1be8281edc31b3fb2d57a71d2c96a47eeeaa6482c0927aa6a4 | SHA256 of 0216ffc6fb679bdf4ea6ee7051213c1e | 2025-03-11 | |
| FileHash-SHA256 | 57d761453bbc6ba9ace467f4491d7a19b9c7e097f81d9772efbcd2f43ada4dce | SHA256 of 872c2ddf6467b1220ee83dca0e118214 | 2025-03-11 | |
| FileHash-SHA256 | 76daea942654d8175f642696fc758b03767db14ca5dda9994797a3f95a34294a | SHA256 of a694ccdb82b061c26c35f612d68ed1c2 | 2025-03-11 | |
| FileHash-SHA256 | 865f5b3b1ee94d89ad9a9840f49a17d477cddfc3742c5ef78d77a6027ad1caa5 | SHA256 of d36a67468d01c4cb789cd6794fb8bc70 | 2025-03-11 | |
| FileHash-SHA256 | a84b3dd5f7d29d8d257fdef0ede512ae09e6cd5be7681b9466a5c60f6f877c2b | SHA256 of 3d9961991e7ae6ad2bae09c475a1bce8 | 2025-03-11 | |
| FileHash-SHA256 | aacaf712cf67176f159657be2fbd0fce018aa03b890cb1616b146eddb1de73be | SHA256 of bd8043127abe3f5cfa61bd2174f54c60 | 2025-03-11 | |
| FileHash-SHA256 | d9e373aeea5fe0c744f0de94fdd366b5b6da816209ac394cbbda1c64c03b50b1 | SHA256 of e9726519487ba9e4e5589a8a5ec2f933 | 2025-03-11 | |
| FileHash-SHA256 | fa95fadc73e5617305a6b71f77e9d255d14402650075107f2272f131d3cf7b00 | SHA256 of 313f9bbe6dac3edc09fe9ac081950673 | 2025-03-11 | |
| URL | http://dgtk.depo-govpk.com/19263687/trui | — | 2025-03-11 | |
| URL | https://dgtk.depo-govpk.com/19263687/trui | — | 2025-03-11 | |
| URL | https://dgtk.depo-govpk.com/19263687/trui' | — | 2025-03-11 | |
| domain | aliyum.email | — | 2025-03-11 | |
| domain | crontec.site | — | 2025-03-11 | |
| domain | d0cumentview.info | — | 2025-03-11 | |
| domain | d0wnlaod.com | — | 2025-03-11 | |
| domain | d0wnlaod.org | — | 2025-03-11 | |
| domain | debcon.live | — | 2025-03-11 | |
| domain | defencearmy.pro | — | 2025-03-11 | |
| domain | depo-govpk.com | — | 2025-03-11 | |
| domain | dirctt88.info | — | 2025-03-11 | |
| domain | dirctt888.com | — | 2025-03-11 | |
| domain | dirctt888.info | — | 2025-03-11 | |
| domain | directt88.com | — | 2025-03-11 | |
| domain | document-viewer.info | — | 2025-03-11 | |
| domain | document-viewer.live | — | 2025-03-11 | |
| domain | documentviewer.info | — | 2025-03-11 | |
| domain | dowmload.co | — | 2025-03-11 | |
| domain | dowmloade.org | — | 2025-03-11 | |
| domain | downl0ad.org | — | 2025-03-11 | |
| domain | file-dwnld.org | — | 2025-03-11 | |
| domain | mevron.tech | — | 2025-03-11 | |
| domain | mod-kh.info | — | 2025-03-11 | |
| domain | modpak-info.services | — | 2025-03-11 | |
| domain | modpak.info | — | 2025-03-11 | |
| domain | mods.email | — | 2025-03-11 | |
| domain | ms-office.pro | — | 2025-03-11 | |
| domain | mteron.info | — | 2025-03-11 | |
| domain | pmd-offc.info | — | 2025-03-11 | |
| domain | pmd-office.info | — | 2025-03-11 | |
| domain | pncert.info | — | 2025-03-11 | |
| domain | portdedjibouti.live | — | 2025-03-11 | |
| domain | session-out.com | — | 2025-03-11 | |
| domain | veorey.live | — | 2025-03-11 | |
| domain | zeltech.live | — | 2025-03-11 | |
| domain | ziptec.info | — | 2025-03-11 | |
| hostname | dgtk.depo-govpk.com | — | 2025-03-11 |