SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
SideCopy is spear-phishing Indian organizations with malicious shortcuts to deploy in-memory ReverseRAT for data theft.
Indian authorities warned that SideCopy is spear-phishing Indian organizations, including academic institutions, to deploy ReverseRAT on Windows. Trellix documented a chain that starts with a ZIP and a disguised LNK shortcut, pulls an obfuscated HTA from docsportal.in, and executes it through mshta.exe. Persistence uses a Registry Run key; a second HTA reflectively loads ReverseRAT, which can steal passwords, screenshots, clipboard data, and files and open remote shells. Reported command-and-control is dns.educationportals.biz over TCP port 5863, protected with a hardcoded key. The advisory rates the threat medium severity.