Breaches and incidents
SideCopy (India): ReverseRAT spear-phishing expands to Indian academic institutions
Trellix researchers (reported by The Hacker News) found SideCopy targeting academic institutions in India, a widening from its usual defence and government...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Trellix researchers (reported by The Hacker News) found SideCopy targeting academic institutions in India, a widening from its usual defence and government focus. A ZIP holds “commskll.docx.lnk” with a spoofed icon; it fetches an obfuscated HTA via mshta.exe, drops a decoy “commskl.docx”, sets a Run-key batch file for persistence and reflectively loads ReverseRAT from a DLL.
- Infrastructure: HTA served from docsportal[.]in; C2/exfiltration dns.educationportals[.]biz on port 5863.
- Attacker: SideCopy (TAG-140), described as Pakistan-origin and overlapping Transparent Tribe, per Trellix.
- Response: IOCs published by Trellix; no victim statements.