Cyber Threat Actor: Sidewinder

Sidewinder, alsotracked under the aliases RattleSnake and PartDook, is a threat actor whose known operational base is located in India. Public reporting associates the group with cyberespionage activities that focus on military and government institutions, particularly in the nations of Nepal and Afghanistan. The actor’s strategic objective, as evidenced by its campaigns, is the collection of sensitive information through intelligence‑gathering operations rather than financial gain or disruptive effects. Targeting appears to be driven by regional geopolitical tensions, with the group exploiting territorial disputes involving China, India, Nepal and Pakistan to craft convincing lures for its victims. These details are drawn from openly available descriptions of the group’s behavior and do not extend beyond the facts presented in the source material.

The group’s typical tactics include spear‑phishing emails designed to harvest credentials, the distribution of emailed backdoors, and the deployment of malicious mobile applications to establish footholds on compromised systems. In the campaign reported on December 9 2020, Sidewinder used phishing messages that referenced recent border conflicts to trick recipients into opening attachments or links that delivered both credential‑stealing payloads and mobile malware, enabling a multi‑platform approach to espionage. The operation successfully exfiltrated data from Nepali military and government targets, illustrating the actor’s ability to combine social engineering with technical tools to achieve its intelligence objectives. While the actor’s location is noted as India, no public source has definitively linked Sidewinder to a specific state sponsor or criminal consortium, so any assertion about affiliation remains unsupported by the provided information. The December 2020 operation stands as a representative example of the group’s publicly reported activity, highlighting its reliance on geopolitical lures, credential phishing, and mobile‑app malware to conduct sustained espionage campaigns.