SideWinder Uncoils to Strike

Delve into an in-depth analysis of the SideWinder threat actor, also known as RattleSnake and T-APT-04, in this 41-minute Black Hat conference talk. Explore the aggressive tactics employed by this APT group, which has been responsible for over a thousand attacks since April 2020. Examine their extensive infrastructure, including hundreds of domains and subdomains used for Download and Command and Control Servers. Follow the infection chain from delivery through various stages of obfuscation and payload deployment. Gain insights into the investigation process and learn effective mitigation strategies to protect against this formidable cyber threat. Presented by Noushin Shabab, this comprehensive briefing provides valuable information for cybersecurity professionals and researchers looking to understand and defend against sophisticated APT actors.

Intro
Sidewinder threat actor
Infection chain
Delivery
First Stage JS obfuscation - 2022
NET downloader
NET Installer
Final Backdoor
Infrastructure
Investigation
Mitigation
Conclusion