SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy used spear-phishing and mshta.exe to deploy ReverseRAT against Indian academic institutions, Trellix reports.
68
Threat actor
Transparent Tribe
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 15, 2026
- Last mentionedSep 22, 2026
Timeline
5 articles · newest firstTransparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Zscaler attributes Operation RapidRust to Pakistan-aligned APT36, targeting Indian and Afghan government and defense entities with new Rust malware and GitHub-based C2.
75
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
78
APT36 Suspected in PATCHCORD Espionage Campaign Using Google Sheets C2
Acronis links the PATCHCORD espionage campaign targeting Afghan telecom and South Asian critical infrastructure to APT36 with moderate confidence.
72
New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.
61
Related CVEs
by mentions- CVE-2024-6387100%8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
Appears with
- APT36threat actor · 4
- SHEETCORDmalware · 2
- BASHNATCHmalware · 2
- Zscaler ThreatLabzorganization · 2
- PATCHCORDmalware · 2
- RUSTYSHADEmalware · 2
- Zscalervendor · 2
- Acronisvendor · 2
- PSNATCHmalware · 2
- Afghan Telecomvendor · 2
- RUSTYMOVEmalware · 2
- Acronis Threat Research Unitorganization · 1
- Indian academic institutionsvictim · 1
- Earth Karkaddanthreat actor · 1
- Seqrite Labsorganization · 1
- PSNATCHproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.