> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing - URL: https://f4n6.co.uk/security-feed/sidecopy-broadens-india-targeting-to-academia-with-reverserat-spear-phishing/ - Published: 2026-09-22T10:48:02.000Z - Updated: 2026-09-22T10:48:02.000Z - Author: Jeff Davies - Tags: #security-feed, SideCopy ## 1\. Executive summary SideCopy, a Pakistan-origin APT group tracked as MITRE G1008 (aka TAG-140, overlapping with the Transparent Tribe cluster), has expanded its targeting from Indian government and defence entities to academic institutions in India, according to a Trellix technical report published 22 September 2026\. The campaign delivers the ReverseRAT remote access trojan, in use by the actor since early 2021, via spear-phishing ZIP archives containing a spoofed LNK file that abuses mshta.exe to fetch and execute a remote HTML Application. The final payload exfiltrates harvested data, including credentials and clipboard content, to a hard-coded C2 domain over port 5863\. No CVE is involved and no CISA-KEV exploitation state applies; the risk to EMEA financial services is low and indirect, limited to exposure through research partnerships, joint programmes, or personnel with ties to Indian academic institutions. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The campaign targets Indian academic institutions, involves no vulnerability in a financial-sector ICT asset, no third-party provider of EMEA clients is identified, and no incident at a client has occurred. Clients with Indian academic partnerships may wish to consider the exposure under their own third-party risk processes, but no article in the provided reference is triggered by a fact distinctive to this item. ## 3\. Technical analysis & attack chain The attack chain below is drawn from a single vendor report (Trellix, 22 September 2026). Attribution to SideCopy is supported by the verified reference data (MITRE G1008), but the technical detail, IOCs, and the claim of a pivot toward academic targeting are single-sourced and should be verified before enforcement actions are based on them. 1. Initial access: spear-phishing delivers a weaponized ZIP archive to the victim. 2. User execution: the archive contains a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension, named "commskll.docx.lnk", designed to look like a legitimate document. 3. Stage one retrieval: the LNK fetches an obfuscated HTML Application (HTA) from the remote server docsportal\[.\]in and executes it via mshta.exe, bypassing standard security controls that do not monitor this LOLBin. 4. Anti-forensics: the malware deletes the HTA file once the subsequent stage initialises, removing disk evidence. 5. Reflective loading: the HTA reflectively loads a DLL payload that acts as a dropper for three embedded components: - appT.bat, a batch script launched via a Windows Registry Run Key to execute startT.hta through mshta.exe without user interaction, establishing persistence. - startT.hta, a secondary stage containing the obfuscated final payload. - commskl.docx, a decoy document shown to the victim. 6. In-memory deobfuscation: the obfuscated code in startT.hta runs a multi-stage deobfuscation routine to reconstruct a two-part XAML payload directly in memory, then reflectively loads an embedded DLL named ioluegnt.dll. The core payload is decoded from a Base64-encoded string into volatile memory via .NET deserialization, evading disk-based detection. 7. Payload execution: ioluegnt.dll is ReverseRAT, giving the operator remote access. ReverseRAT capabilities, as documented by Trellix: collection of system metadata and installed software lists; screenshot capture; password and clipboard harvesting; file operations; arbitrary command execution; Registry-based persistence; file upload; and spawning a shell session. C2 traffic is encrypted with a hard-coded cryptographic key, "NMXIKS09?:709,!\~lnsYUS". Exfiltrated data is sent over port 5863 to dns.educationportals\[.\]biz, which resolves to 45.61.157\[.\]22. Context from prior reporting: Seqrite Labs attributed a separate SideCopy spear-phishing campaign against Afghanistan's Ministry of Finance to the open-source Xeno RAT in June 2026, indicating the actor uses multiple RAT families. SideCopy has been active since at least 2019 and historically targets Indian defence forces and government officials. ## 4\. Mitigation & containment This campaign has no CVE to patch. Containment rests on blocking the observed infrastructure and restricting the execution path the actor depends on. ### P1, within 24 hours - Block dns.educationportals\[.\]biz and 45.61.157\[.\]22 at the DNS resolver, proxy, and firewall, including outbound port 5863 to that IP if egress filtering permits granular rules. - Hunt for the artefact chain on endpoints with India exposure or academic-sector contact: files named commskll.docx.lnk, appT.bat, startT.hta, commskl.docx, and ioluegnt.dll, plus any HTA file fetched from docsportal\[.\]in. - If your EDR supports it, block or alert on mshta.exe executing remote or local HTA content; mshta.exe abuse is the delivery mechanism at two stages of this chain and is the single control point that breaks both. ### P2, within 72 hours - Audit Run Key persistence for entries launching batch scripts or HTA files via mshta.exe; the observed persistence mechanism launches appT.bat through a Registry Run Key. - Review web and DNS logs for the period covered by your retention for requests to docsportal\[.\]in and connections to 45.61.157\[.\]22 on port 5863. - Alert on mshta.exe spawning from wscript.exe or from explorer.exe following LNK execution, and on .NET deserialization activity in processes with no on-disk assembly. ### P3, within 7 days - If mshta.exe is not required by any business application, remove it via Attack Surface Reduction rules or application control. This actor has used it across multiple campaigns since at least 2019 and will continue to. - Brief staff with ties to Indian academic or government sectors that spear-phishing targeting that community is active, and that archived LNK files spoofing document icons are the current lure format. ## 5\. Indicators of compromise All indicators are single-sourced from the Trellix report. | type | value | confidence | source | | --------- | ------------------------------- | ---------------------- | --------------------------- | | domain | docsportal\[.\]in | medium, single-sourced | Trellix via The Hacker News | | domain | dns.educationportals\[.\]biz | medium, single-sourced | Trellix via The Hacker News | | ipv4 | 45.61.157\[.\]22 | medium, single-sourced | Trellix via The Hacker News | | filename | commskll.docx.lnk | medium, single-sourced | Trellix via The Hacker News | | filename | appT.bat | medium, single-sourced | Trellix via The Hacker News | | filename | startT.hta | medium, single-sourced | Trellix via The Hacker News | | filename | commskl.docx | medium, single-sourced | Trellix via The Hacker News | | filename | ioluegnt.dll | medium, single-sourced | Trellix via The Hacker News | | mutex/key | C2 key: NMXIKS09?:709,!\~lnsYUS | medium, single-sourced | Trellix via The Hacker News | ```iocs domain docsportal[.]in domain dns.educationportals[.]biz ipv4 45.61.157[.]22 filename commskll.docx.lnk filename appT.bat filename startT.hta filename commskl.docx filename ioluegnt.dll ``` The hard-coded C2 key "NMXIKS09?:709,!\~lnsYUS" is retained in the table for detection engineering but omitted from the copyable block because it is a string constant rather than a machine-pivotable atomic indicator. No file hashes were published in the source material. ## 6\. Detection The sources provide filenames, a C2 key, and a C2 destination. No file hashes are available, so the YARA rule below is string-based and will match the named artefacts if encountered; treat hits as high-priority and pull the sample for analysis. ```yara rule SideCopy_ReverseRAT_Stage_Artefacts { meta: author = "Adverse Trace" date = "2026-09-22" reference = "https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html" description = "Detects SideCopy ReverseRAT stage files by filename and hard-coded C2 key, per Trellix reporting" strings: $lnk = "commskll.docx.lnk" wide ascii $bat = "appT.bat" wide ascii $hta = "startT.hta" wide ascii $doc = "commskl.docx" wide ascii $dll = "ioluegnt.dll" wide ascii $key = "NMXIKS09?:709,!~lnsYUS" ascii condition: 2 of them } ``` ```yaml title: SideCopy ReverseRAT C2 beacon to educationportals infrastructure id: 7f3c2a91-4d58-4e1b-9a60-2c8e5f1d3b74 status: experimental description: Detects outbound connection to SideCopy ReverseRAT C2 over the observed port and host, per Trellix reporting 2026-09-22 references: - https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html author: Adverse Trace date: 2026-09-22 logsource: category: network_connection product: windows detection: selection_destination: DestinationHostname|endswith: '.educationportals.biz' selection_ip: DestinationIp: '45.61.157.22' selection_port: DestinationPort: 5863 condition: 1 of selection_* falsepositives: - Legitimate services on port 5863 are rare; verify any hit level: high ``` ## Threat actor context **SideCopy** · [G1008](https://attack.mitre.org/groups/G1008?ref=f4n6.co.uk) [SideCopy](https://attack.mitre.org/groups/G1008?ref=f4n6.co.uk) is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019\. [SideCopy](https://attack.mitre.org/groups/G1008?ref=f4n6.co.uk)'s name comes from its infection chain that tries to mimic that of [Sidewinder](https://attack.mitre.org/groups/G0121?ref=f4n6.co.uk), a suspected Indian threat group. ## 7\. Sources - The Hacker News, "SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing", https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html, 2026-09-22 (reporting on a Trellix technical report by Boggavarapu R S S Srinivas Gupta and Ravishankar N C) ## 8\. Adverse Trace position We assess this campaign as low direct risk to EMEA financial services: the targeting is regional, aimed at Indian academia and government, and no financial-sector victim or third-party provider is identified in the reporting. The technical detail and IOC set are single-sourced from Trellix, so we recommend verification before enforcement, and the attribution to SideCopy is consistent with the verified MITRE G1008 profile. The techniques themselves, mshta.exe abuse, LNK lures, Registry Run Key persistence, and in-memory .NET payload execution, are actor-agnostic and worth defending against regardless of who deploys them. We will monitor for corroboration of the academic-targeting pivot and for any expansion of SideCopy targeting beyond South Asia, and we will update this advisory if a second source confirms the infrastructure or additional victims emerge. --- [Read the original source →](https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*