Breaches and incidents
SideCopy (India): MSI-based campaigns hit railways, oil and gas, defence and MEA themes; government site used to host payloads
Seqrite tracked SideCopy activity from late December 2024 (phishing dated 13 and 15 Jan 2025) using decoys for the National Defence College (NDC-65...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Seqrite tracked SideCopy activity from late December 2024 (phishing dated 13 and 15 Jan 2025) using decoys for the National Defence College (NDC-65 calendar), Southern Railway, HPCL “cybersecurity guidelines”, Ministry of External Affairs and universities, plus a fake e-governance domain phishing several Maharashtra municipal corporations; the National Hydrology Project (Ministry of Water Resources) site was compromised to host payloads.
- Technique: ZIPs with .pdf.lnk shortcuts running msiexec quietly to fetch remote MSI packages (replacing HTA); new CurlBack RAT via DLL sideloading with a scheduled task named “OneDrive”; modified Spark RAT for Linux; custom Xeno RAT.
- Attacker: SideCopy (Pakistan-linked), high confidence per Seqrite.
- Response: detections and IOCs published.