Sidewinder — Threat Actor Profile, Campaigns & Targets

Threat entity extracted from intelligence sources

Frequency
6
occurrences
First Seen
November 14, 2025
Last Seen
June 8, 2026

Sidewinder is an apt_group tracked by ThreatCluster, appearing in 6 threat clusters built from 6 intelligence report mentions.

Sidewinder is a apt_group tracked across 6 threat clusters and 6 intelligence report mentions on ThreatCluster. First observed November 14, 2025; most recent activity June 8, 2026.

Related Threat Clusters

Recent Intelligence Reports

  • T1203 · Exploitation for Client Execution — attack.mitre.org · June 8, 2026
  • SideWinder Uses Fake Chrome PDF Viewer and Zimbra Clone to Steal Government Webmail Credentials — Cybersecuritynews · April 21, 2026
  • SideWinder Spoofs Chrome PDF Viewer, Zimbra to Steal Government Webmail Logins — Gbhackers · April 21, 2026
  • BlindEagle Hackers Attacking Government Agencies with Powershell Scripts — Cybersecuritynews · December 22, 2025
  • Microsoft "mitigates" Windows LNK flaw exploited as zero — Bleepingcomputer · December 3, 2025
  • India's cyberthreat matrix for 2026 : Kaspersky GReAT expert — Ciso.Economictimes.Indiatimes · November 14, 2025

Frequently asked questions

What is Sidewinder?

Sidewinder is an apt_group tracked by ThreatCluster, appearing in 6 threat clusters built from 6 intelligence report mentions.

Is Sidewinder still active?

The most recent intelligence report mentioning Sidewinder on ThreatCluster is dated June 8, 2026. Activity was first observed November 14, 2025, giving a tracked span from then to June 8, 2026.

What is Sidewinder associated with?

Across ThreatCluster reporting, Sidewinder most frequently co-occurs with Andariel, Apt12, Apt28, Apt29, APT3, among 12 tracked related entities.

What are the latest developments involving Sidewinder?

The most significant recent cluster is “SideWinder Targets South Asian Governments with Phishing Campaign” (2 articles · Updated April 21, 2026). Sidewinder appears across 6 threat clusters in total, listed above with sources.

How much reporting does ThreatCluster have on Sidewinder?

Sidewinder appears in 6 intelligence report mentions across 6 deduplicated threat clusters, aggregated from 17,000+ monitored sources.

CVSS v3.1 Breakdown