SideCopy spear-phishing spreads ReverseRAT to Indian academia

SideCopy, a threat group that has spent years targeting Indian government and defence organisations, is now using spear-phishing to go after academic institutions in India, and its campaigns deliver a remote access trojan called ReverseRAT. That is the finding of a technical report by the security firm Trellix, whose researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C documented the attack chain step by step.

Spear-phishing means sending a message that looks trustworthy so that the recipient opens an attachment or clicks a link. The Trellix researchers said SideCopy operations typically begin this way and abuse mshta.exe, a legitimate Windows program that runs HTML applications, to execute malicious scripts and circumvent standard security protocols. That delivery mechanism, they wrote, then installs the remote access trojan, which they called the central pillar of the group's offensive infrastructure. A remote access trojan, or RAT, is software that quietly gives an attacker control over a victim's computer.

SideCopy, an advanced persistent threat group also tracked under the name TAG-140, has been active since at least 2019. According to the report it originates from Pakistan and shares overlaps with a cluster known as Transparent Tribe. Its historical targets have been Indian defence forces and government officials, which makes the move towards universities, colleges and research bodies a notable shift in emphasis. The group is not new to changing its focus. In a report published in June 2026, Seqrite Labs attributed to SideCopy a spear-phishing campaign that targeted Afghanistan's Ministry of Finance and used an open-source remote access trojan called Xeno RAT.

The attack chain described by Trellix starts with a weaponised ZIP archive, which is a compressed folder sent as an email attachment. Inside it sits a Windows shortcut, also called an LNK file, named commskll.docx.lnk. The file carries a PDF-style icon and adds the .docx extension used by Word documents so that it looks like a harmless document, while the .lnk ending is what Windows actually acts on. Opening it causes the machine to fetch an obfuscated HTML Application, or HTA, from a remote server at docsportal[.]in and run it through mshta.exe. The HTA then reflectively loads a DLL payload. A DLL is a file of code that other programs load and use. The malware also uses an anti-forensic self-deletion routine that removes the HTA file once the next stage has been initialised, which makes the infection harder to reconstruct after the fact.

That DLL acts as a dropper, meaning it carries and installs further pieces of the attack. Trellix found three embedded components. The first, appT.bat, is a batch script launched through a Windows Registry Run Key, a Windows setting that tells the system what to start automatically at sign-in. It runs startT.hta using mshta.exe without requiring any action from the user. The second, startT.hta, is a secondary exploit stage containing the obfuscated final payload. The third, commskl.docx, is a decoy document, most likely displayed so that the victim believes an ordinary file was opened. According to Trellix, the obfuscated code inside startT.hta runs a multi-stage deobfuscation routine that reconstructs a two-part XAML payload directly in memory. XAML is a Microsoft markup format used to describe application content. The same stage reflectively loads another embedded DLL, ioluegnt.dll. To evade detection tools that scan files on disk, the malware decodes its core payload into volatile memory, moving from a Base64-encoded string (a way of writing data using only plain text characters) into an active process in memory through .NET Deserialization, a technique that rebuilds an object in memory from stored data.

The final DLL is ReverseRAT, which SideCopy has put to use since early 2021. Trellix describes it as a tool for data exfiltration, remote execution and persistence. It can gather system metadata, a list of installed software, screenshots, passwords and clipboard content, carry out file operations, run commands, set up persistence through the Windows Registry, upload files and spawn a shell session on the victim's machine. Its command-and-control traffic, meaning the channel the malware uses to receive orders and send stolen data, is encrypted with a hard-coded key, the string NMXIKS09?:709,!~lnsYUS. Harvested data is exfiltrated over port 5863 to the domain dns.educationportals[.]biz, which resolves to the IP address 45.61.157[.]22.

Trellix concluded that SideCopy's current activities underscore a disciplined and highly strategic approach to intelligence collection, and that while the group's historical focus has been Indian government entities, its recent pivot towards academic institutions highlights an expanding set of strategic priorities. The researchers added that by continuously refining its infection stages, most notably through heavy abuse of mshta.exe and complex, multilayered obfuscation, the group remains a formidable and adaptive adversary for regional security. For anyone running a website, a business or an IT estate, the mechanics of the chain matter as much as the attribution: it needs no software flaw and no macro-enabled document to work. It depends on a person opening an attachment and on a legitimate Windows tool that most organisations cannot simply switch off, which is why awareness of odd archive attachments and file names with a double ending remains one of the most practical defences, alongside security tools that watch what programs do after they start rather than only what files look like on disk.

Organisations that would rather have that groundwork planned and maintained for them can look at AEU-I, the security-first IT, infrastructure and consulting service, whose page sets out what it covers for businesses and IT teams.