Watch Floor
State-backedIndiaMITRE G0121

RAZOR TIGER

Also known as SideWinder, Rattlesnake, APT-C-17, T-APT-04

0mentions, 7 days
0mentions, 30 days
nonelast mentioned

An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.

Targets: Government, Military, Private Sector, China, Pakistan, Nepal, Afghanistan

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1016 System Network Configuration DiscoveryT1020 Automated ExfiltrationT1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1033 System Owner/User DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1057 Process DiscoveryT1059.001 PowerShellT1059.005 Visual BasicT1059.007 JavaScriptT1071.001 Web ProtocolsT1074.001 Local Data StagingT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1105 Ingress Tool TransferT1119 Automated CollectionT1124 System Time DiscoveryT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1218.005 MshtaT1518 Software DiscoveryT1518.001 Security Software DiscoveryT1547.001 Registry Run Keys / Startup FolderT1559.002 Dynamic Data ExchangeT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1574.001 DLLT1598.002 Spearphishing AttachmentT1598.003 Spearphishing Link

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.