THREAT OPS › Threat News › VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder
VTPRACTITIONERS{ACRONIS}: Tracking FileFix, Shadow Vector, and SideWinder
<h1 style="text-align: left;">Introduction </h1> <div class="interval_12">We have recently started a new blog series called #VTPRACTITIONERS. This series aims to share with the community what other practitioners are able to research using VirusTotal from a technical point of view. </div> <div class="interval_12">Our first blog saw our colleagues at <a href="https://blog.virustotal.com/2025/10/vir
Attributed threat actors
- APT-C-36G0099
- SidewinderG0121
MITRE ATT&CK techniques
Indicators of compromise
- 62544cb1f0b9e6e04433698e85bfb534278b9bdc5f06589c011e9cb80c71df23sha256
- 1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35asha256
- 40fc70e61157b3903a7517b9928c87784070af59d533cdbae5ca2d4d7cbb45acsha256
- 15818f97142d49cbc9662d51bb0155a7a8dc650bf1daf26e07a5fff4ff15d93fsha256
- 6d4a53da259c3c8c0903b1345efcf2fa0d50bc10c3c010a34f86263de466f5a1sha256
- 2aae8e206dd068135b16ff87dfbb816053fc247a222aad0d34c9227e6ecf7b5bsha256
- 4cfeab122e0a748c8600ccd14a186292f27a93b5ba74c58dfee838fe28765061sha256
- 9bbbcb6eae33314b84f5e367f90e57f487d6abe72d6067adcb66eba896d7ce33sha256
- 60e87c0fe7c3904935bb1604bdb0b0fc0f2919db64f72666b77405c2c1e46067sha256
- 609edc93e075223c5dc8caaf076bf4e28f81c5c6e4db0eb6f502dda91500aab4sha256
- 4795d3a3e776baf485d284a9edcf1beef29da42cad8e8261a83e86d35b25cafesha256
- 5673ad3287bcc0c8746ab6cab6b5e1b60160f07c7b16c018efa56bffd44b37aasha256
- b3e8ab81d0a559a373c3fe2ae7c3c99718503411cc13b17cffd1eee2544a787bsha256
- b5311cadc0bbd2f47549f7fc0895848adb20cc016387cebcd1c29d784779240csha256
- c3319a8863d5e2dc525dfe6669c5b720fc42c96a8dce3bd7f6a0072569933303sha256
- cb035f440f728395cc4237e1ac52114641dc25619705b605713ecefb6fd9e563sha256
- cf23f7b98abddf1b36552b55f874ae1e2199768d7cefb0188af9ee0d9a698107sha256
- f3208ae62655435186e560378db58e133a68aa6107948e2a8ec30682983aa503sha256
- 0c91dbdf806b35d57c332e71ff73c5e18ca86e1d1906099543698b3155c95ca7sha256
- 06471e1f500612f44c828e5d3453e7846f70c2d83b24c08ac9193e791f1a8130sha256
- 70ae293eb1c023d40a8a48d6109a1bf792e1877a72433bcc89613461cffc7b61sha256
- 2692fe1070152501a8b85deacf45fb68444c00b42e6447e69c5e301f75ad3e43sha256
- CVE-2017-0199cve
- CVE-2017-11882cve
- 1HXdHnxuzkW8tMfoWxHK4LvXojJDhE6jGbtc
- https://www.acronis.com/en/tru/url
- https://www.acronis.com/en/tru/posts/from-banks-to-battalions-sidewinders-attacks-on-south-asias-public-sector/url
- https://www.acronis.com/en/tru/posts/shadow-vector-targets-colombian-users-via-privilege-escalation-and-court-themed-svg-decoys/url
- https://docs.virustotal.com/docs/writing-yara-rules-for-livehunturl
- https://www.virustotal.com/gui/search/tag%253ACVE-2017-11882?type=filesurl
- https://www.virustotal.com/gui/file/1955c6914097477d5141f720c9e8fa44b4fe189e854da298d85090cbc338b35aurl
- https://www.virustotal.com/gui/file/40fc70e61157b3903a7517b9928c87784070af59d533cdbae5ca2d4d7cbb45ac/behaviorurl
- https://www.virustotal.com/gui/file/15818f97142d49cbc9662d51bb0155a7a8dc650bf1daf26e07a5fff4ff15d93furl
- https://"url
- https://gtidocs.virustotal.com/docs/diffurl
- https://www.acronis.com/en/tru/about/url
- https://www.acronis.com/en/tru/posts/filefix-in-the-wild-new-filefix-campaign-goes-beyond-poc-and-leverages-steganography/url
- https://logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-techniqueurl
- https://gtidocs.virustotal.com/docs/livehunt-guideurl
- https://www.virustotal.com/gui/url/0c91dbdf806b35d57c332e71ff73c5e18ca86e1d1906099543698b3155c95ca7/contenturl
Original source: https://blog.virustotal.com/2025/11/vtpractitioners-acronis.html