← threat actors
threat actor · IN
RAZOR TIGER
also tracked as sidewinder 2
2 stories · 2 in the wild · August 6, 2026 – September 20, 2026
evidence: 2 observed
geography
- italy 1 · Sep 20
- uk 1 · Sep 20
malware and tools
- clickonce 1 · Aug 6
- rust backdoor 1 · Aug 6
techniques
- dll sideloading 2 · Sep 20
- persistence 1 · Aug 6
attack phases seen
- Execution 2 · Sep 20
- Defense evasion 1 · Sep 20
- Command and control 1 · Aug 6
- Initial access 1 · Aug 6
- Persistence 1 · Aug 6
what we reported, newest first, grouped by story
September 20, 2026
- SideWinder samples are circulating signed with Microsoft-issued certificates under the name "Alysen Mendez", using Azure blob storage for staging and C2 and spoofing their User-Agent as CrowdStrike's
CsAgent/7.04.18110.0. malwrhunterteam found a second, differently signed DLL in an ISO named SSA-Statement-09112026-*.iso seen from the UK and Italy — so this is more than one cert. malwrhunterteam
· Sep 20 · observed · as sidewinder · Threat Activity
August 6, 2026
- SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird).
· Aug 6 · observed · via phishing email · as sidewinder · Threat Activity