G0121 - Sidewinder

Name: G0121 - Sidewinder
Creator: Maltiverse
Published: 2023-08-14

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.

Author: agomez
Created: 2023-08-14 15:24:23
Last updated: 2026-02-07 19:24:56
Downloads: 282657
Hostname indicators: 177
URL indicators: 35
Sample indicators: 18

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

president-gov-lk.donwloaded.net Hostname

modified 2026-10-18 00:40:48
SideWinder (ThreatFox Abuse.ch)

fmprc-gov-cn.dowmload.co Hostname

modified 2026-10-18 00:38:58
SideWinder (ThreatFox Abuse.ch)

update.ms-office.app Hostname

modified 2026-10-18 00:37:00
SideWinder (ThreatFox Abuse.ch)

mail-nespak-com-pk.gwadarportt.workers.dev Hostname

modified 2026-10-18 00:36:19
SideWinder (ThreatFox Abuse.ch)

mail-ecp-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-18 00:35:26
SideWinder (ThreatFox Abuse.ch)

cloud-ptclnetpk.servehttp.com Hostname

modified 2026-10-17 20:37:33
SideWinder (ThreatFox Abuse.ch)

forecast.com Hostname

modified 2026-10-17 20:37:33
SideWinder (ThreatFox Abuse.ch)

mail-modp-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 16:40:55
SideWinder (ThreatFox Abuse.ch)

mail-modp-gov-pk.pak-gov-pk.workers.dev Hostname

modified 2026-10-17 16:40:16
SideWinder (ThreatFox Abuse.ch)

support-ntc.servehttp.com Hostname

modified 2026-10-17 16:40:14
SideWinder (ThreatFox Abuse.ch)

eservice-ptclnetpk.servehttp.com Hostname

modified 2026-10-17 16:40:07
SideWinder (ThreatFox Abuse.ch)

awards-piacaero.servehttp.com Hostname

modified 2026-10-17 16:39:58
SideWinder (ThreatFox Abuse.ch)

president-gov-ik.donwloaded.net Hostname

modified 2026-10-17 16:39:44
SideWinder (ThreatFox Abuse.ch)

mail-mofapk.servehttp.com Hostname

modified 2026-10-17 16:39:28
SideWinder (ThreatFox Abuse.ch)

hrmis-financegovpk.serveftp.com Hostname

modified 2026-10-17 16:38:56
SideWinder (ThreatFox Abuse.ch)

news-ptvcompk.servehttp.com Hostname

modified 2026-10-17 16:38:06
SideWinder (ThreatFox Abuse.ch)

mailsco-govpk.myvnc.com Hostname

modified 2026-10-17 12:39:49
SideWinder (ThreatFox Abuse.ch)

mail-paf-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 12:38:19
SideWinder (ThreatFox Abuse.ch)

offer-ptclnetpk.servehttp.com Hostname

modified 2026-10-17 12:37:57
SideWinder (ThreatFox Abuse.ch)

mail-invest-gov-pk.gwadarportt.workers.dev Hostname

modified 2026-10-17 12:37:32
SideWinder (ThreatFox Abuse.ch)

mail-sco-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 10:51:02
SideWinder (ThreatFox Abuse.ch)

mail-mofagovpk.myddns.me Hostname

modified 2026-10-17 08:41:36
SideWinder (ThreatFox Abuse.ch)

mail-hitgovpk.servegame.com Hostname

modified 2026-10-17 08:40:47
SideWinder (ThreatFox Abuse.ch)

mail-hit-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 08:37:53
SideWinder (ThreatFox Abuse.ch)

mail-pc-gov-pk-login.ethanhunthero125.workers.dev Hostname

modified 2026-10-17 04:40:13
SideWinder (ThreatFox Abuse.ch)

mail-mod-gov-pk.pakistan-gov-pk.workers.dev Hostname

modified 2026-10-17 04:36:40
SideWinder (ThreatFox Abuse.ch)

elccorp-net.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 04:35:56
SideWinder (ThreatFox Abuse.ch)

mail-gwadarport-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 00:40:29
SideWinder (ThreatFox Abuse.ch)

gwadarport-gov-pk.gwadarportt.workers.dev Hostname

modified 2026-10-17 00:40:24
SideWinder (ThreatFox Abuse.ch)

mail-dgdp-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-17 00:38:01
SideWinder (ThreatFox Abuse.ch)

dowmload.co Hostname

modified 2026-10-17 00:36:20
SideWinder (ThreatFox Abuse.ch)

mail-depo-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-16 20:40:15
SideWinder (ThreatFox Abuse.ch)

worker-orange-unit-abfb.gwadarportt.workers.dev Hostname

modified 2026-10-16 20:37:26
SideWinder (ThreatFox Abuse.ch)

news.ntc-telecomcorporation.workers.dev Hostname

modified 2026-10-16 16:40:26
SideWinder (ThreatFox Abuse.ch)

webmail-gda-gov-pk.gwadarportt.workers.dev Hostname

modified 2026-10-15 16:39:34
SideWinder (ThreatFox Abuse.ch)

mofa-gov-pk.dowmload.co Hostname

modified 2026-10-15 16:39:21
SideWinder (ThreatFox Abuse.ch)

5d0f8a3466264f53ff9f62a3718309a47be63e95fd7323ebd467d4680c3c9508 Sample

modified 2026-10-10 20:04:32
SideWinder (Cyber Threat Alliance)

8d90a3b4e12d2e733f77797ffa1bc537c5e7afa30e1319caf45e97d1a402f7fa Sample

modified 2026-10-10 20:04:32
SideWinder (Cyber Threat Alliance)

af218a5efd2ae99acd1a040b4b92c65c4c093ae96e899c1ca911e4ca6a1a71bc Sample

modified 2026-10-09 19:55:31
SideWinder (Cyber Threat Alliance)

office.document-viewer.info Hostname

modified 2026-10-07 17:38:20
SideWinder (ThreatFox Abuse.ch)

jiqaz.com Hostname

modified 2026-10-04 14:17:50
Sidewinder (Maltiverse) · Gamaredon Group (Maltiverse) · Razor Tiger (Maltiverse) · Malware Download (URLhaus Abuse.ch) · TeamBot (ThreatFox Abuse.ch)

erd.gov.lk.mofa-govbd.com Hostname

modified 2026-09-29 10:58:31
SideWinder (ThreatFox Abuse.ch)

mofa.gov.bd.mofa-govbd.com Hostname

modified 2026-09-25 15:05:09
SideWinder (ThreatFox Abuse.ch)

mofa-gov-pk.download.info Hostname

modified 2026-09-25 04:39:48
SideWinder (ThreatFox Abuse.ch)

pnwc.bol-north.com Hostname

modified 2026-09-23 14:40:58
Sidewinder (Maltiverse) · Razor Tiger (Maltiverse) · Malicious URL (Hybrid-Analysis) · SideWinder (ThreatFox Abuse.ch)

sarabanmithnavvtni-mil.com Hostname

modified 2026-09-23 09:51:52
SideWinder (ThreatFox Abuse.ch)

kenaikan.portdedjibouti.live Hostname

modified 2026-09-18 07:00:14
SideWinder (ThreatFox Abuse.ch)

sarabanmithnavy.tni-mil.com Hostname

modified 2026-09-18 06:59:54
SideWinder (ThreatFox Abuse.ch)

http://slpa.mod-gov.org/5946/1/5790/2/0/0/0/m/files-a3d0041a/file.rtf URL

modified 2026-09-10 23:46:12
SideWinder (ThreatFox Abuse.ch)

mfagov.info Hostname

modified 2026-09-10 00:38:40
SideWinder (ThreatFox Abuse.ch)

mail-armylk.myvnc.com Hostname

modified 2026-09-09 20:58:02
SideWinder (ThreatFox Abuse.ch)

moittadvisory.pmd-offc.info Hostname

modified 2026-09-09 17:58:20
SideWinder (ThreatFox Abuse.ch)

notsaied.site Hostname

modified 2026-09-09 05:33:45
Sidewinder (Maltiverse) · Gamaredon Group (Maltiverse) · Razor Tiger (Maltiverse) · Malware Download (URLhaus Abuse.ch)

slpa.mod-gov.org Hostname

modified 2026-09-09 04:29:38
Sidewinder (Maltiverse) · Razor Tiger (Maltiverse) · Gamaredon Group (Maltiverse) · Malware Download (URLhaus Abuse.ch) · SideWinder (ThreatFox Abuse.ch)

www-erd-gov-lk.dwnlld.info Hostname

modified 2026-08-27 20:55:04
SideWinder (ThreatFox Abuse.ch)

4a83420375c564b987d3dfbc073aa963 Sample

modified 2026-08-25 01:29:20
Generic Malware (Hybrid-Analysis) · SideWinder (MalwareBazaar Abuse.ch) · Generic Malware (Triage)

mail-dmp-navy-pk.dytt88.org Hostname

modified 2026-08-20 16:54:44
SideWinder (ThreatFox Abuse.ch)

http://sarabanmithnavy.tni-mil.com/importanmail/785871/file.rtf URL

modified 2026-08-16 20:03:12
SideWinder (ThreatFox Abuse.ch)

https://kenaikan.portdedjibouti.live/Notice_483075/doc.rtf URL

modified 2026-08-16 17:31:35
SideWinder (ThreatFox Abuse.ch)

mofa-gov-bd.fia-gov.net Hostname

modified 2026-08-14 07:56:09
SideWinder (ThreatFox Abuse.ch)

mofa-gov-sa.direct888.net Hostname

modified 2026-08-11 13:52:17
SideWinder (ThreatFox Abuse.ch)

https://president-gov-lk.donwloaded.net/a4884a53/file.rtf URL

modified 2026-08-11 13:52:16
SideWinder (ThreatFox Abuse.ch)

https://moitt-gov-pk.fia-gov.net/659949null/file.rtf URL

modified 2026-08-11 13:52:16
SideWinder (ThreatFox Abuse.ch)