Side Copy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
Summary: SideCopy, a Pakistan-origin APT active since at least 2019 and also tracked as TAG-140, has shifted from targeting Indian defense and government entities to spear-phishing academic institutions in India. Trellix documented a chain in which a weaponized ZIP delivers a LNK file disguised as a document ("commskll.docx.lnk"), which fetches an obfuscated HTA from "docsportal[.]in" and runs it via mshta.exe to reflectively load a DLL dropper for the ReverseRAT trojan, which exfiltrates data over port 5863 to "dns.educationportals[.]biz" (45.61.157[.]22).
What's compelling: ReverseRAT has been in SideCopy's hands since early 2021 and is built to pull screenshots, passwords, clipboard content and installed-software lists, with C2 traffic encrypted under a hard-coded key - so an infection on an academic network hands over credentials and research data, not just a foothold.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026