The distinctive rattle of APT SideWinder

Group‑IB and Bridewell present a joint analysis of SideWinder APT activity, revealing hunting rules (Shodan/Censys) and 119 IPs/domains (55 previously unknown) tied to targeted phishing campaigns against organizations primarily in Pakistan and China; the report documents malicious documents and LNK/HTA loaders, an Android downloader APK (DEX payload encrypted with AES‑256), WHOIS links between domains, and provides IOC tables and mitigation guidance.