RST TI Report Digest: 03 Aug 2026

SideWinder APT (aka G0121 / T-APT-04) is a long-running espionage group that in 2024 broadened operations from South Asian government and military targets to critical infrastructure and diplomatic missions across 18 countries; the report documents their use of spear-phishing lures exploiting CVE-2017-11882 to deploy a memory-only implant named StealerBot (capable of stealing keystrokes, browser passwords, and RDP credentials) and provides extensive IOCs (IPs, domains, and file hashes) and observed TTPs, with no confirmed breaches of nuclear OT reported.