MalwareUsed by 2 actors

WarHawk

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SideWinder

Recently, Zscaler ThreatLabz discovered a new malware being used by the SideWinder APT threat group in campaigns targeting Pakistan: a backdoor we’ve called “WarHawk.”

via zscaler threat labzzscaler.com

SloppyLemming

"Prior campaigns ... have leveraged malware families like ... WarHawk"

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1190 Initial Access Exploit Public Facing Application

T1566PhishingEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1566 Initial Access Phishing

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1059 Execution Command and Scripting Interpreter

T1204User ExecutionEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1204 Execution User Execution

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The custom Cobalt Strike loader used by the SideWinder APT leverages the KernelCallBackTable Process injection ... to load the Cobalt Strike beacon

Stealth

3 techniques

T1055Process InjectionEvidence1

The custom Cobalt Strike loader used by the SideWinder APT leverages the KernelCallBackTable Process injection ... to load the Cobalt Strike beacon

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1140 Defense Evasion Deobfuscate/Decode Files or Information

T1564Hide ArtifactsEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1564 Defense Evasion Hide Artifacts

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1071.001 Command and Control Application Layer Protocols - Web Protocols

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1041 Exfiltration Exfiltration over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in app8 months ago

hash.md5●●●●●●●●●●●●View more in app8 months ago

uri●●●●●●●●●●●●View more in app8 months ago

hash.md5●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Mar 3, 2026

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

Malware family used in prior campaigns (capabilities not described in this content).

zscaler threat labzNews

Jan 1, 2026

WarHawk: New APT backdoor from SideWinder | Zscaler

A modular backdoor used by SideWinder in espionage campaigns targeting Pakistan. It gathers host information, beacons to C2, executes commands, enumerates drives and files for exfiltration, uploads files from C2 to the victim, and downloads/executes stage-2 payloads including Cobalt Strike.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 2 actors

WarHawk

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SideWinder

Recently, Zscaler ThreatLabz discovered a new malware being used by the SideWinder APT threat group in campaigns targeting Pakistan: a backdoor we’ve called “WarHawk.”

via zscaler threat labzzscaler.com

SloppyLemming

"Prior campaigns ... have leveraged malware families like ... WarHawk"

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1190Exploit Public-Facing ApplicationEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1190 Initial Access Exploit Public Facing Application

T1566PhishingEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1566 Initial Access Phishing

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1059 Execution Command and Scripting Interpreter

T1204User ExecutionEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1204 Execution User Execution

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

The custom Cobalt Strike loader used by the SideWinder APT leverages the KernelCallBackTable Process injection ... to load the Cobalt Strike beacon

Stealth

3 techniques

T1055Process InjectionEvidence1

The custom Cobalt Strike loader used by the SideWinder APT leverages the KernelCallBackTable Process injection ... to load the Cobalt Strike beacon

T1140Deobfuscate/Decode Files or InformationEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1140 Defense Evasion Deobfuscate/Decode Files or Information

T1564Hide ArtifactsEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1564 Defense Evasion Hide Artifacts

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1071.001 Command and Control Application Layer Protocols - Web Protocols

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK TTP MAPPING ID TACTIC TECHNIQUE T1041 Exfiltration Exfiltration over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

4 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

uri●●●●●●●●●●●●View more in app8 months ago

hash.md5●●●●●●●●●●●●View more in app8 months ago

uri●●●●●●●●●●●●View more in app8 months ago

hash.md5●●●●●●●●●●●●View more in app8 months ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Mar 3, 2026

SloppyLemming Targets Pakistan and Bangladesh Governments Using Dual Malware Chains

Malware family used in prior campaigns (capabilities not described in this content).

zscaler threat labzNews

Jan 1, 2026

WarHawk: New APT backdoor from SideWinder | Zscaler

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching12

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.