SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
The threat actor SideCopy, originating from Pakistan and linked to the Transparent Tribe cluster, has broadened its targeting beyond Indian government entities to include academic institutions in India. They are utilizing sophisticated spear-phishing campaigns leveraging mshta.exe to deploy a Remote Access Trojan (RAT) called ReverseRAT, which is used for data exfiltration, remote execution, and persistence. The campaign employs complex obfuscation and layered techniques to evade detection.
The threat actor SideCopy, originating from Pakistan and associated with the Transparent Tribe cluster, has significantly expanded its targeting strategy, now focusing on academic institutions within India. Historically, SideCopy has primarily targeted Indian defense forces and government officials. Their operations typically begin with spear-phishing campaigns that exploit the abuse of mshta.exe to execute malicious scripts and bypass standard security protocols, deploying a remote access trojan (RAT) known as ReverseRAT.
In a recent campaign documented by Trellix, attackers leveraged spear-phishing to deliver a weaponized ZIP archive containing a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk"). This file was used to fetch an obfuscated HTML Application (HTA) from a remote server ("docsportal[.]in"), which was then executed using "mshta.exe." The mshta.exe process reflectedively loaded an embedded DLL payload, namely "ioluegnt.dll."
The DLL serves as a dropper for three embedded components: an appT.bat batch script, a startT.hta secondary exploit stage, and a decoy document, commskl.docx. The obfuscated code within startT.hta executes a multi-stage deobfuscation routine to reconstruct a two-part XAML payload directly in memory, which then loads an embedded DLL ("ioluegnt.dll").
To evade disk-based detection, the malware decodes its core payload into volatile memory space, transitioning from a Base64-encoded string to an active, in-memory process via .NET Deserialization. The command-and-control (C2) traffic is encrypted using a hard-coded cryptographic key ("NMXIKS09?:709,!~lnsYUS"). The harvested data is exfiltrated via port 5863 to "dns.educationportals[.]biz," which resolves to the IP address "45.61.157[.]22." SideCopy has been utilizing ReverseRAT since early 2021 for data exfiltration, remote execution, and persistence. The malware is equipped to gather system metadata, a list of installed software, screenshots, passwords, and clipboard content; perform file operations; run commands; set up persistence via Registry; upload files; and spawn a shell session.