SideCopy Expands Targeting to Indian Academic Institutions

• •SideCopy has expanded its targeting to Indian academic institutions.
• •The attack method involves spear-phishing emails with weaponized ZIP archives.
• •The ReverseRAT malware can collect sensitive data and maintain persistence.

The threat actor SideCopy has broadened its targeting to include academic institutions in India, moving away from its historical focus on government entities. This APT group, active since at least 2019 and originating from Pakistan, has been observed using spear-phishing tactics to deploy a remote access trojan (RAT) known as ReverseRAT. The attack method involves spear-phishing emails containing weaponized ZIP archives, which include a Windows shortcut file disguised as a PDF. This shortcut executes a malicious HTML Application (HTA) file using mshta.exe, leading to the loading of a DLL payload. The malware is capable of collecting sensitive data, executing commands remotely, and maintaining persistence. The command-and-control traffic is encrypted, indicating a sophisticated level of operation. The shift in focus to academic institutions suggests an evolving strategy for SideCopy.