Back Scworld

SideCopy threat actor targets Indian academic institutions with new attack methods

Scworld • September 23, 2026

The threat actor known as SideCopy has expanded its targeting to include academic institutions in India, shifting its focus from primarily government entities, The Hacker News reports.

SideCopy, an advanced persistent threat group originating from Pakistan and active since at least 2019, has historically targeted Indian defense forces and government officials. The latest observed campaign, detailed in a technical report by Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C, utilizes spear-phishing emails containing weaponized ZIP archives. These archives hold a Windows shortcut file (.lnk) disguised with a PDF icon and a .DOCX extension to appear legitimate. This LNK file executes a malicious HTML Application (HTA) using mshta.exe, which then loads a DLL payload. The malware employs an anti-forensic routine to delete the HTA file.

The DLL acts as a dropper for a batch script and a secondary exploit stage, which ultimately deploys the ReverseRAT remote access trojan. ReverseRAT is capable of collecting sensitive data, executing commands remotely, and maintaining persistence. Command-and-control traffic is encrypted, and data is exfiltrated to a specific IP address. This pivot to academic institutions suggests an expanding set of strategic priorities for the group.

Source: The Hacker News

SC Staff September 22, 2026

SC Staff September 21, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SideCopy Expands Targeting to Indian Academic Institutions The threat actor SideCopy has broadened its targeting to include academic institutions in India, moving away from its historical focus on government entities. This APT group, active since at least 2019 and originating from Pakistan, has been observed using spear-phishing tactics to deploy a remote access trojan (RAT) known as ReverseRAT. The attack method involves spear-phishing emails containing weaponized ZIP archives, which include a Windows shortcut file disguised as a PDF. This shortcut executes a malicious HTML Application (HTA) file using mshta.exe, leading to the loading of a DLL payload. The malware is capable of collecting sensitive data, executing commands remotely, and maintaining persistence. The command-and-control traffic is encrypted, indicating a sophisticated level of operation. The shift in focus to academic institutions suggests an evolving strategy for SideCopy. 2 sources 68

Extracted Entities

SideCopy threat actor targets Indian academic institutions with new attack methods

The full story

Extracted Entities

APT Groups (1)

Attack Types (2)

Countries (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)