RAZOR TIGERThreat actor
- apt-c-17
- rattlesnake
- SideWinder
- t-apt-04
An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.From MISP Galaxy
Last reported 3 years ago, by Group-IB2 reports
What the reports say
2 reports, newest first · the exact sentence from each-
The distinctive rattle of APT SideWinder“The distinctive rattle of APT SideWinder”
-
SideWinder.AntiBot.Script“Group-IB Threat Intelligence researchers have discovered a new malicious infrastructure and a custom tool of the APT group SideWinder (aka Rattlesnake, Hardcore Nationalist, RAZOR TIGER, T-APT-04 and APT-C-17), a threat actor that is believed to be originating from India and prim…”
Indicators in its reports
named in the reports above- csd.gov[.]pkin 1 report
- a74f9baa1791476c…c8c6fd0822cdin 1 report
- hxxp://5.2.79[.]135/!/n/in 1 report
- 5.2.79[.]135in 1 report
- 2.56.245[.]21in 1 report
- csd.pakgov[.]netin 1 report
- hajj.pakgov[.]netin 1 report
- pt.pakgov[.]netin 1 report
- flix.pakgov[.]netin 1 report
- finance.gov[.]pkin 1 report
- hxxp://faujifoundation.bitlyy[.]me/offer-55f9918fin 1 report
- faujifoundation.bitlyy[.]mein 1 report
- hxxps://applicants.fauji.org[.]pk/in 1 report
- applicants.fauji.org[.]pkin 1 report
- hxxps://www.fauji.org[.]pk/in 1 report
- www.fauji.org[.]pkin 1 report
- hxxps://finance.pakgov[.]net/salary-a4222e91in 1 report
- finance.pakgov[.]netin 1 report
- hxxps://www.finance.gov[.]pk/circulars/circular_14042022_2.pdfin 1 report
- www.finance.gov[.]pkin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.