MalwareUsed by 1 actor

BroaderAspect

BroaderAspect is a .NET loader previously used by TAG-140 in campaigns targeting Indian government organizations. In the reported infection chain, victims were lured via a ClickFix-style social engineering workflow that spoofed the Indian Ministry of Defence and induced execution of a malicious script through mshta.exe. That execution led to the BroaderAspect loader, which established persistence and then installed and launched DRAT V2. The activity was assessed by Insikt Group as overlapping with SideCopy, an operational affiliate or subcluster linked to Transparent Tribe (APT36/ProjectM/MYTHIC LEOPARD), with moderate-confidence attribution to TAG-140. The broader campaign targeted Indian entities, including government and defense-related organizations, with reported expansion to organizations affiliated with India’s railway, oil and gas, and external affairs ministries. High-confidence behavior directly described for BroaderAspect is persistence establishment and staging/execution of the DRAT V2 remote access trojan as a subsequent payload.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

SideCopy

"...led to the execution of the BroaderAspect .NET loader... BroaderAspect establishes persistence and subsequent DRAT V2 installation and execution."

via dark readingdarkreading.com

MITRE ATT&CK

Techniques & procedures

2 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

"The threat group gains initial access to a victim's device through what Insikt Group considers to be a ClickFix-style social engineering lure... they suspect the attackers used spear-phishing emails."

Stealth

1 technique

T1218.005MshtaEvidence1

"Victims were enticed to execute a malicious script via mshta.exe, which led to the execution of the BroaderAspect .NET loader"

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

dark readingNews

Jul 8, 2025

TAG-140 Targets Indian Government Via 'ClickFix-Style' Lure

.NET loader used in the intrusion chain to establish persistence and install/execute DRAT V2.

recorded future blogNews

Jun 19, 2025

Analysis of TAG-140 Campaign and DRAT V2 Development Targeting Indian Government Organizations

.NET loader used in the infection chain to establish persistence and install/execute DRAT V2.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping2

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BroaderAspect