SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy used spear-phishing and mshta.exe to deploy ReverseRAT against Indian academic institutions, Trellix reports.
Trellix reports that Pakistan-linked SideCopy, also known as TAG-140, used spear-phishing to target academic institutions in India, expanding beyond government and defense. A ZIP delivers a shortcut named commskll.docx.lnk that fetches an HTA from docsportal.in and runs it with mshta.exe, reflectively loading a DLL that drops ReverseRAT. The RAT collects system data, screenshots, passwords, and clipboard content, persists via a Registry Run key, and exfiltrates over port 5863 to dns.educationportals.biz (45.61.157.22). Seqrite previously tied SideCopy to an Xeno RAT campaign against Afghanistan’s Ministry of Finance.
68