Top Highlights
- SideCopy targets Indian academic and government institutions using spear-phishing with weaponized ZIP archives and malicious LNK files to deploy multi-stage payloads, including in-memory DLLs for stealth.
- The threat leverages mshta.exe to execute obfuscated HTML applications and drop remote access trojans like ReverseRAT, enabling data exfiltration, remote control, and persistence.
- Attack traffic is encrypted and exfiltrated via hard-coded keys to specific ports and domains, underscoring a sophisticated, strategic approach to cyber espionage with expanding targets beyond government entities.
Threat, Attack Techniques, and Targets
The threat actor known as SideCopy uses spear-phishing to target specific groups, mainly in India. They aim at academic institutions as well as government officials and defense forces. The latest attacks involve sending malicious ZIP files. Inside, there is a shortcut file (.LNK) that looks like a PDF to seem safe. When opened, this file directs the system to fetch a malicious HTML Application (HTA) from a remote server and run it. This process uses “mshta.exe” to execute the code. The HTA file then loads a DLL payload secretly into memory. The malware uses a self-deletion routine to hide its activities.
The DLL is a Remote Access Trojan (RAT) called ReverseRAT. Since early 2021, SideCopy has used ReverseRAT for data theft, remote commands, and persistence. ReverseRAT can collect system information, capture screenshots, steal passwords, browse files, and run commands. It also maintains a backdoor to keep access and communicate with the attackers. The command-and-control traffic is encrypted and communicates with servers over specific ports.
Impact, Security Implications, and Remediation Guidance
This threat can lead to significant data loss where personal, academic, or strategic information is stolen. The use of complex obfuscation makes detection difficult. For institutions, this represents a serious security risk. Attackers can use the stolen data for espionage or planning future attacks. It is important for affected organizations to identify and block these malicious activities quickly.
Security teams should review their email filters, update antivirus tools, and monitor for signs of spear-phishing. They should also check for unusual network traffic and suspicious files. Because of the sophisticated methods used, remediation guidance should be obtained from the relevant security vendor or authority. It is strongly advised to seek official advice to properly remove malware and strengthen defenses.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
