Sidewinder
IntrusionSet · ATTACK:enterprise:G0121
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0121",
"title": "Sidewinder",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0121",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--3fc023b2-c5cc-481d-9c3e-70141ae1a87e",
"external_id": "G0121",
"domain": "enterprise",
"created": "2021-01-27T15:57:11.183Z",
"modified": "2026-07-31T18:47:50.955Z",
"version": "1.2",
"aliases": [
"Sidewinder",
"T-APT-04",
"Rattlesnake"
],
"tactics": [
],
"source_references": [
{
"source_name": "T-APT-04"
},
{
"source_name": "Rattlesnake"
},
{
"source_name": "Cyble Sidewinder September 2020",
"url": "https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"
},
{
"source_name": "Securelist APT Trends April 2018",
"url": "https://securelist.com/apt-trends-report-q1-2018/85280/"
},
{
"source_name": "ATT Sidewinder January 2021",
"url": "https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"
}
]
}Explicit source assertions (31)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0841fe7b-657e-47e9-b4c9-ec812043a41c
ATT Sidewinder January 2021 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cf2ae01-9d19-46d7-949e-e6d7a5639a95
Rewterz Sidewinder APT April 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ecbbfa3-6b81-4cf7-9033-373ebbc2832f
Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1598.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--107dc621-6f5d-4b59-9873-54355e55312d
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10cf6efc-6415-4a80-834a-565057e76474
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--118e5be5-a143-4e2f-b80f-20b580f14210
ATT Sidewinder January 2021 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bf421b0-1faf-403d-a8c6-3f5eb90d7c9d
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e9f6719-24c5-4c8b-a832-506f46bbadb6
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--326d0ed6-35a6-452e-a8a2-ab2a7e034faa
ATT Sidewinder January 2021 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32e947a4-cbd3-45a8-ae74-7e51edf84d81
Cyble Sidewinder September 2020 · ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d2736f6-5ce8-48ba-8be0-e8d8ab0a3a9c
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--400ed882-80e9-47f7-85a6-11996fbbb635
ATT Sidewinder January 2021 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d43c968-d9d2-4687-949e-23888376f10c
Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60be159a-b083-48c2-bd38-4abb873d1f30
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67583965-9e89-49cd-bdac-9fd69d7857ae
Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cce15df-4e0c-4eac-b597-5a301d450546
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9eb64003-16d8-4b2d-b5e5-206130e5dd17
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1598.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a28e6ec8-0519-40e7-b252-90205dfbe5d9
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4e89138-7df9-4be1-9d45-4089f1744ad0
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a55c163c-3eb8-47a2-8ad1-3a667b4ac129
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab058a49-a8fc-403d-ae97-9137625c82d7
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afbd6b8a-8636-401c-b04d-e0aa584fa6fa
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b30cc0be-74f0-42a6-85ef-594d6d184bae
ATT Sidewinder January 2021 · Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5766b7d-0a7d-4bbc-8a44-211825de80db
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbfb1a32-4582-4ecb-8a0e-4c76caaa5063
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccb80607-a8bf-4e6b-a3e3-1755cd317552
Rewterz Sidewinder COVID-19 June 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2ea2645-1940-4776-a874-09309f75636a
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:S0250
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eab4c1aa-d84d-4111-ab87-710345bdd31d
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f1ef0014-9d3d-407a-aa86-8aab6c92edda
ATT Sidewinder January 2021 · Rewterz Sidewinder APT April 2020 · Rewterz Sidewinder COVID-19 June 2020 · Cyble Sidewinder September 2020ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc43ba07-ffa2-4617-95ac-7ff6462eccd0
ATT Sidewinder January 2021ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff49e4df-4693-4df5-adf8-15e765963155
ATT Sidewinder January 2021