SideCopy APT Group Targets Indian Academia with ReverseRAT

Executive Summary

The Pakistani-nexus advanced persistent threat (APT) group SideCopy has historically targeted Indian defense and government entities. Recent analysis from Trellix reveals a strategic shift, with the group now expanding its operations to include academic institutions in India. A new campaign leverages a classic spear-phishing vector to deploy the ReverseRAT backdoor. The attack chain is multi-staged, beginning with a malicious LNK file and using mshta.exe to execute remote HTA scripts, ultimately leading to the in-memory execution of the .NET-based RAT. The use of reused command-and-control (C2) infrastructure indicates this is an evolution of ongoing operations rather than a new initiative.

Threat Overview

SideCopy, a threat actor known for mimicking the TTPs of the India-nexus Sidewinder group, has launched a new campaign that signals an expansion of its intelligence collection priorities. While maintaining its focus on espionage against India, the inclusion of academic institutions suggests an interest in research, intellectual property, or compromising individuals within the academic sector who may have ties to the government.

The attack starts with a spear-phishing email containing a ZIP archive. Inside the archive is a Windows Shortcut (.LNK) file masquerading as a document. When the victim opens the LNK file, it triggers a chain of events designed to evade detection and establish a foothold on the target system. The group shows operational security awareness by deleting intermediate files and using reflective loading techniques to keep the final payload off the disk.

Technical Analysis

The infection chain observed in this campaign follows a well-documented but effective pattern used by SideCopy:

1. Initial Access: A spear-phishing email delivers a ZIP archive (T1566.001 - Spearphishing Attachment). The archive contains a malicious LNK file with a .docx.lnk extension and a PDF icon to deceive the user (T1204.002 - Malicious File).
2. Execution & Staging: Upon execution, the LNK file invokes mshta.exe to download and run an obfuscated HTML Application (HTA) file from a remote server, docsportal[.]in (T1218.005 - Mshta).
3. In-Memory Payload: The initial HTA script reflectively loads a dropper DLL into memory. This DLL is responsible for dropping three components, including a batch script for persistence. The HTA file is then deleted to hinder forensic analysis (T1620 - Reflective Code Loading).
4. Persistence: The batch script creates a Windows Registry Run Key (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) to ensure the malware executes on system startup (T1547.001 - Registry Run Keys / Startup Folder). The Run Key points to a secondary HTA file, startT.hta.
5. Final Payload Delivery: The startT.hta script uses multi-stage deobfuscation to reconstruct a XAML payload. This payload leverages .NET deserialization to reflectively load the final payload, ReverseRAT, into memory (T1127.001 - Template Injection).
6. Command and Control: The ReverseRAT backdoor communicates with the C2 server dns.educationportals[.]biz. The traffic is encrypted with a hard-coded AES key (T1071.001 - Application Layer Protocol: Web Protocols). This domain has been associated with SideCopy since at least June 2025.

ReverseRAT provides standard RAT capabilities, including file exfiltration, command execution, screen capture, and theft of credentials and system information.

Impact Assessment

The expansion of SideCopy's targeting to academic institutions poses a significant espionage risk. These institutions often conduct sensitive research, collaborate with government and defense organizations, and house personal data on students and faculty who could be future government employees. A successful compromise could lead to the theft of valuable intellectual property, sensitive government-related research, and personally identifiable information (PII) for future targeting operations. The attack's reliance on user execution of a malicious file highlights the ongoing risk posed by phishing, even to security-aware organizations.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect related activity:

Detection & Response

Detection:

• Endpoint Detection and Response (EDR): Monitor for the execution of mshta.exe with a URL as a command-line argument. EDR solutions should be configured to log process chains, which would show an LNK file execution leading to mshta.exe. D3FEND's Process Lineage Analysis is key.
• Network Security: Block or alert on connections to the known malicious domains (docsportal[.]in, dns.educationportals[.]biz). Use a web proxy to inspect and block downloads of HTA files from untrusted sources. This aligns with D3FEND's Outbound Traffic Filtering (D3-OTF).
• Email Security: Configure email gateways to block or quarantine emails with ZIP attachments containing LNK files. Analyze attachments for suspicious characteristics like double extensions.

Response:

1. Isolate the compromised host from the network.
2. Block the IOCs at the network perimeter.
3. Investigate process execution logs and registry modifications to identify the scope of the compromise.
4. Remove the persistence mechanism from the registry.
5. Re-image the affected machine to ensure complete eradication of the malware.

Mitigation

• User Training: Conduct regular phishing awareness training, focusing on identifying malicious attachments and links. Emphasize the danger of files with misleading icons or double extensions (M1017 - User Training).
• Attack Surface Reduction: Block HTA files at the email gateway and web proxy. If mshta.exe is not required for business operations, consider blocking its execution via application control policies like AppLocker (M1038 - Execution Prevention).
• File Extension Visibility: Configure Windows to show file extensions by default. This helps users distinguish a malicious .lnk file from a legitimate .docx file (M1028 - Operating System Configuration).
• Endpoint Protection: Ensure antivirus and EDR solutions are enabled and up-to-date. Configure them to monitor for suspicious script execution and registry modifications.