APT / THREAT GROUP

SideWinder

aliases

Last seen:May 19, 2026

Intelligence Profile

SideWinder involved a fake VPN app for Android devices published on Google Play Store along with a custom tool that filters victims for better targeting.

Threat Analysis

SideWinder is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf

→https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewinder

→https://medium.com/@DCSO_CyTec/404-file-still-found-d52c3834084c

→https://medium.com/@Sebdraven/apt-sidewinder-tricks-powershell-anti-forensics-and-execution-side-loading-5bc1a7e7c84c

→https://otx.alienvault.com/pulse/5fd10760f9afb730d37c4742/

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

SideWinderapk.sidewinderwin.sidewinder

External Intelligence

Malpedia: win.sidewinder

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search SideWinder