SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy APT group targets Indian academia with ReverseRAT via spear-phishing.
The Pakistan-based APT group SideCopy, also known as TAG-140, has expanded its targeting in India to include academic institutions, moving beyond its historical focus on government entities. The group employs spear-phishing campaigns that abuse mshta.exe to deliver its ReverseRAT malware, which is capable of extensive data exfiltration and remote control.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Trellix?
Get an email when a new story names Trellix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Pakistan-linked APT group SideCopy has expanded its spear-phishing campaigns beyond Indian government targets to now include academic institutions, exploiting the often-weaker security postures found in educational environments. The attacks abuse mshta.exe, a legitimate Windows binary, to execute malicious HTA files delivered via convincing phishing lures — a technique known as 'living off the land' that bypasses many traditional defenses. Once ReverseRAT is deployed, attackers gain persistent remote access and can exfiltrate sensitive research, credentials, and institutional data. This expansion highlights how APT groups deliberately pivot to softer targets within a nation's critical ecosystem when primary targets harden their defenses.
What helps against this
How we list vendors- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — docsportal[.]in
- domain — dns.educationportals[.]biz
- ip — 45.61.157[.]22
- malware — ReverseRAT
- malware — Xeno RAT
- mitre_attack — T1059.003
- mitre_attack — T1566.002
- mitre_attack — T1071.001
- mitre_attack — T1041
- mitre_attack — T1027
- mitre_attack — T1140
- mitre_attack — T1053.005
- mitre_attack — T1553.005
- mitre_attack — T1003
- mitre_attack — T1113
- mitre_attack — T1115
- mitre_attack — T1083
- mitre_attack — T1082
- mitre_attack — T1547.001