SideWinder Uncoils to Strike
summary
SideWinder (aka RattleSnake / T-APT-04) runs over a thousand attacks since April 2020 and keeps hundreds of domains; campaigns use RTF/oxml/lnk lures that drop obfuscated HTA/JavaScript which decrypts and loads .NET downloader and installer stages, then deploys files (rekvis.exe, user.dll, random.tmp) to achieve DLL sideloading and a memory-resident .NET backdoor that enumerates AVs, collects chosen file extensions, and fetches/upgrades C2 pieces; practical defenses are Office patching, app whitelisting and URL/network pattern detection.
AI-written summary · about
chapters (12)
- 0:00Intro
- 2:10Sidewinder threat actor
- 5:36Infection chain
- 9:18Delivery
- 13:06First Stage JS obfuscation - 2022
- 16:12NET downloader
- 17:10NET Installer
- 21:02Final Backdoor
- 25:11Infrastructure
- 28:35Investigation
- 33:30Mitigation
- 34:54Conclusion
related talks
29mThe Wolf in Sheep's Clothing: How Cybercriminals Leverage OneNote for Stealthy...
44mAnatomy and Defense of LOTL Fileless Intrusions
42mDriven Response to UNC5174
17mRadRAT: An all-in-one toolkit for complex espionage ops
41m"Revenge of The Script Kiddies: Current Day Uses..."
50mReflected File Download - A New Web Attack Vector
42mCracking the Perimeter with SharpShooter
25mRaiders of the Javascript-based Malware