Loading story…
Pakistan-linked APT group SideCopy (also tracked as TAG-140) has expanded beyond its established focus on Indian government and defense organizations to target Indian academic institutions. Spear-phishing emails deliver ZIP archives containing a Windows LNK shortcut masquerading as a DOCX/PDF document; opening it retrieves an HTA payload from docsportal[.]in and launches it using the legitimate mshta.exe utility.
The multi-stage chain employs reflective DLL loading, .NET deserialization, in-memory payload execution, obfuscation, registry-based persistence, and self-deletion to limit file-based detection. The final ReverseRAT implant can collect system, user, credential, clipboard, and screenshot data; execute commands; manipulate files; open a shell; and exfiltrate data through encrypted C2 traffic over port 5863 to dns.educationportals[.]biz, which resolves to 45.61.157[.]22.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Seqrite Labs reported that SideCopy conducted a spear-phishing campaign against Afghanistan's Ministry of Finance using the open-source Xeno RAT.
SideCopy began using the ReverseRAT remote-access trojan, which supports reconnaissance, credential and clipboard theft, screenshots, command execution, file operations, persistence, and shell access.
SideCopy broadened its historical focus on Indian government and defense targets to academic institutions in India. The campaign delivered ZIP archives containing disguised LNK files that used mshta.exe to retrieve an HTA-based infection chain ending in ReverseRAT.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
mkd-cirt.mk
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **SideCopy** espionage group targeted Indian defence organizations and armed forces personnel with spear-phishing campaigns using military-themed and honeytrap lures, including DRDO procurement documents, foreign assignment selections, personal photos, and reports about clashes involving soldiers. Across multiple campaigns, the attackers delivered malicious archives, disguised `LNK` files, and template-injection documents exploiting `CVE-2017-11882`, then used `mshta.exe` to retrieve remote `HTA` payloads, display decoy content, and establish persistence through `VBS` scripts, BAT files, and registry `Run` entries. The intrusion chains deployed several remote-access tools, including **MargulasRAT**, **Action RAT** variants, and a newly observed **.NET-based RAT**, while also abusing the legitimate `credwiz.exe` binary for DLL sideloading. Investigators said the malware exfiltrated files from user directories, collected host information, and communicated with command-and-control infrastructure over ports such as `1443`, `2443`, and `3443`, with some payload URLs hidden behind TinyURL links and others hosted on domains including `elfinindia[.]com`. The activity was tied to SideCopy operations active since 2019 and was assessed as closely aligned with, or possibly a subdivision of, **Transparent Tribe** based on overlapping tradecraft, infrastructure, and targeting.
Aug 15, 2026
Pakistan-linked threat activity targeting Indian organizations has expanded across government, defense, education, and energy sectors, with researchers tying much of the activity to **Transparent Tribe (APT36)** and **SideCopy**. Seqrite reported that SideCopy ran multiple spear-phishing campaigns using malicious `LNK` files, `MSHTA`, staged `HTA` and `DLL` payloads, and dual **AllaKore RAT** variants against Indian government and military-themed targets, while Transparent Tribe used `XLAM` add-ins, macro-enabled files, and updated **Crimson RAT** delivery chains. Infrastructure overlaps, malware similarities, and passive DNS correlations were cited as evidence linking the groups, and lures referenced Indian Ministry of Defence allowances, DGMS themes, and Army posting policies to increase credibility. Other reporting shows the same broader espionage pattern has persisted for years and widened beyond traditional military targets. SentinelOne, K7, and Seqrite documented Transparent Tribe campaigns against Indian educational institutions using malicious Office documents and `.NET` malware with **Crimson RAT**-like behavior, while Cyble described a defense-themed malware chain delivered in a `.vhdx` image that checked for India Standard Time before deploying a second-stage payload. Separately, EclecticIQ's **Operation FlightNight** targeted Indian government entities and private energy companies with an ISO-delivered stealer based on **HackBrowserData**, exfiltrating browser data and selected documents to attacker-controlled Slack workspaces; analysts linked it to an earlier **Go-Stealer** campaign and assessed the motive as cyber espionage.
Aug 15, 2026
Transparent Tribe (`APT36`), a suspected Pakistan-aligned threat actor, targeted India’s education sector with malicious Microsoft Office documents designed to deliver **Crimson RAT**. Researchers said the campaign used both traditional macro-enabled files and a newer `OLE` embedding technique that tricks victims into double-clicking a fake **"View Document"** prompt, launching the malware under the filename `MicrosoftUpdate.exe`. SentinelOne identified multiple **Crimson RAT** `.NET` variants compiled between July and September 2022 that used the command-and-control domain `richa-sharma.ddns[.]net`. The samples showed anti-analysis delays, persistence checks, and differing obfuscation approaches, including **Eazfuscator**, indicating continued tool refinement as the group broadened its targeting beyond Indian military and government entities to include educational institutions and students across the subcontinent.
Jul 12, 2026