RAZOR TIGER — Threat Actors — SecurityStudies.info

Profile

Also known as: APT-C-17, Rattlesnake, SideWinder, T-APT-04

An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages.

ATT&CK techniques · 30

Reconnaissance

T1598.002Spearphishing Attachment T1598.003Spearphishing Link

Initial Access

T1566.001Spearphishing Attachment T1566.002Spearphishing Link

Execution

T1059.001PowerShell T1059.005Visual Basic T1059.007JavaScript T1203Exploitation for Client Execution T1204.001Malicious Link T1204.002Malicious File T1559.002Dynamic Data Exchange T1574.001DLL

Persistence

T1547.001Registry Run Keys / Startup Folder

Stealth

T1027.010Command Obfuscation T1027.013Encrypted/Encoded File T1036.005Match Legitimate Resource Name or Location T1218.005Mshta

Discovery

T1016System Network Configuration Discovery T1033System Owner/User Discovery T1057Process Discovery T1082System Information Discovery T1083File and Directory Discovery T1124System Time Discovery T1518Software Discovery T1518.001Security Software Discovery

Collection

T1074.001Local Data Staging T1119Automated Collection

Command and Control

T1071.001Web Protocols T1105Ingress Tool Transfer

Exfiltration

T1020Automated Exfiltration

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential