{"id":3049,"date":"2026-09-22T09:53:22","date_gmt":"2026-09-22T09:53:22","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3049"},"modified":"2026-09-22T09:53:22","modified_gmt":"2026-09-22T09:53:22","slug":"sidecopy-broadens-india-targeting-to-academia-with-reverserat-spear-phishing","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3049","title":{"rendered":"SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 22, 2026<\/span><\/span>Malware \/ Cyber Espionage<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The threat actor known as SideCopy<\/strong> has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities.<\/p>\n

\u00abSideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols,\u00bb Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said<\/a> in a technical report.<\/p>\n

\u00abThis delivery mechanism facilitates the deployment of a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure.\u00bb<\/p>\n

Active since at least 2019, SideCopy<\/a> (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster. Historically, the threat actor has primarily targeted Indian defense forces and government officials.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan’s Ministry of Finance with an open-source remote access trojan called Xeno RAT.<\/p>\n

<\/p>\n

The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension (\u00abcommskll.docx.lnk\u00bb) to make the malicious file look legitimate.<\/p>\n

The LNK file is used to fetch an obfuscated HTML Application (HTA) from a remote server (\u00abdocsportal[.]in\u00bb) and execute it using \u00abmshta.exe,\u00bb which then proceeds to reflectively load a DLL payload. The malware makes use of an anti-forensic self-deletion routine that deletes the HTA file once the subsequent stage is initialized.<\/p>\n

\"\"<\/a><\/div>\n

The DLL serves as a dropper for three embedded components –<\/p>\n