SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy used spear-phishing and mshta.exe to deploy ReverseRAT against Indian academic institutions, Trellix reports.
Trellix reports that Pakistan-linked SideCopy, also known as TAG-140, used spear-phishing to target academic institutions in India, expanding beyond government and defense. A ZIP delivers a shortcut named commskll.docx.lnk that fetches an HTA from docsportal.in and runs it with mshta.exe, reflectively loading a DLL that drops ReverseRAT. The RAT collects system data, screenshots, passwords, and clipboard content, persists via a Registry Run key, and exfiltrates over port 5863 to dns.educationportals.biz (45.61.157.22). Seqrite previously tied SideCopy to an Xeno RAT campaign against Afghanistan’s Ministry of Finance.
- SideCopy spear-phished Indian academia with a ZIP containing a disguised LNK.
- The LNK fetches an HTA executed by mshta.exe, then loads a DLL in memory.
- ReverseRAT steals metadata, screenshots, passwords, and clipboard data.
- C2 uses dns.educationportals.biz on port 5863, resolving to 45.61.157.22.
- The Pakistan-linked group overlaps Transparent Tribe and previously targeted Afghanistan.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1218.005 MshtaT1547.001 Registry Run Keys / Startup FolderT1041 Exfiltration Over C2 Channel
- Threat actors
- SideCopyTransparent Tribe
- Malware
- ReverseRATXeno RAT
- Organizations
- TrellixSeqrite Labs
- Countries
- IndiaPakistanAfghanistan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | docsportal.in | an obfuscated HTML Application (HTA) from a remote server ("docsportal[.]in") and execute it using "mshta.exe," which then proceeds t |
| domain | educationportals.biz | "). The harvested data is exfiltrated via port 5863 to "dns.educationportals[.]biz," which resolves to the IP address "45.61.157[.]22." "The |
From the original article
2 min read at thehackernews.com
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta. exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.