{
  "id": "sidewinder",
  "name": "Sidewinder",
  "aliases": [
    "T-APT-04",
    "Rattlesnake"
  ],
  "domain": "cyber",
  "country": "IND",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "IND"
  ],
  "summary": "Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Suspected Indian group",
      "src": [
        "mitre-g0121"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2012,
      "src": [
        "mitre-g0121"
      ],
      "conf": "medium",
      "note": "At least 2012"
    },
    {
      "k": "attack_id",
      "v": "G0121",
      "src": [
        "mitre-g0121"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.",
      "src": [
        "mitre-g0121"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 30,
      "src": [
        "mitre-g0121"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Koadic",
      "src": [
        "mitre-g0121"
      ],
      "conf": "high",
      "note": "1 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0121)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/sidewinder.html",
  "sources": {
    "mitre-g0121": {
      "title": "Sidewinder, Group G0121",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0121/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}