[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fycUCdXDvoHp5TVBY9WMeHyR8lY1HQA27X0-I-_xsq20":3},{"article":4,"iocs":50,"watch_terms":111,"solutions":112,"lesson":199},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"b73461dc-23db-45b4-a037-63ae6ae4457a","SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing","sidecopy-broadens-india-targeting-to-academia-with-reverserat-spear-phishing-c8f864","The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. \"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols,\" Trellix researchers","The Pakistan-based APT group SideCopy, also known as TAG-140, has expanded its targeting in India to include academic institutions, moving beyond its historical focus on government entities. The group employs spear-phishing campaigns that abuse mshta.exe to deliver its ReverseRAT malware, which is capable of extensive data exfiltration and remote control.","SideCopy APT group targets Indian academia with ReverseRAT via spear-phishing.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fsidecopy-broadens-india-targeting-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgVXTuBFDgZyaNFTznwdu5HXSKuVHU5xpM7JDvXP_Ra-68CsYd68bb6xMWPXbjmsM5oO211hZgzIN0NENk_cMBZZpL88LMsIaNkfSEpIWRRzyjRt7Ke6ZMeUXvIKcH3ncgDouKN8FGuunAFQFMolel0GgTBm1lzdVDH28WpWFUCI4Fvl9ju0q4Vv0S55PVx\u002Fs1600\u002Fword-school.jpg","2026-09-22T07:52:03+00:00","2026-09-22T10:00:20.142049+00:00",8,[17,20,22,24],{"name":18,"type":19},"SideCopy","threat_actor",{"name":21,"type":19},"TAG-140",{"name":23,"type":19},"Transparent Tribe",{"name":25,"type":26},"Trellix","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55,58,62,65,68,72,75,78,81,84,87,90,93,96,99,102,105,108],{"type":52,"value":53,"context":54},"domain","docsportal[.]in","Malicious domain used to host HTA payload.",{"type":52,"value":56,"context":57},"dns.educationportals[.]biz","Command and control (C2) domain for data exfiltration.",{"type":59,"value":60,"context":61},"ip","45.61.157[.]22","IP address associated with the C2 domain dns.educationportals[.]biz.",{"type":44,"value":63,"context":64},"ReverseRAT","Remote Access Trojan (RAT) used by SideCopy.",{"type":44,"value":66,"context":67},"Xeno RAT","Open-source RAT previously attributed to SideCopy.",{"type":69,"value":70,"context":71},"mitre_attack","T1059.003","Abuse of mshta.exe for script execution.",{"type":69,"value":73,"context":74},"T1566.002","Spear-phishing attachment.",{"type":69,"value":76,"context":77},"T1071.001","Web protocols for C2 communication.",{"type":69,"value":79,"context":80},"T1041","Exfiltration over C2 channel.",{"type":69,"value":82,"context":83},"T1027","Obfuscated files or information.",{"type":69,"value":85,"context":86},"T1140","Deobfuscate\u002Fdecode files or information.",{"type":69,"value":88,"context":89},"T1053.005","Scheduled task\u002Ftimer.",{"type":69,"value":91,"context":92},"T1553.005","Mark-of-the-Web bypass.",{"type":69,"value":94,"context":95},"T1003","OS credential dumping.",{"type":69,"value":97,"context":98},"T1113","Screen capture.",{"type":69,"value":100,"context":101},"T1115","Clipboard data.",{"type":69,"value":103,"context":104},"T1083","File and directory discovery.",{"type":69,"value":106,"context":107},"T1082","System information discovery.",{"type":69,"value":109,"context":110},"T1547.001","Registry Run Keys \u002F Startup Folder.",[25],{"controls":113,"vendors":198},[114,140,169],{"slug":115,"name":116,"problem":117,"products":118},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","ringfencing","Ringfencing","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fringfencing","Limits what approved applications may do, such as which files, network locations and other programs they can reach, so a compromised application cannot be turned against you.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":136,"product_name":137,"url":138,"description":139},"allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"slug":141,"name":142,"problem":143,"products":144},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[145,153,161],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":154,"vendor_name":155,"vendor_logo":156,"product_slug":157,"product_name":158,"url":159,"description":160},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":162,"vendor_name":163,"vendor_logo":164,"product_slug":165,"product_name":166,"url":167,"description":168},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":170,"name":171,"problem":172,"products":173},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[174,182,190],{"vendor_slug":175,"vendor_name":176,"vendor_logo":177,"product_slug":178,"product_name":179,"url":180,"description":181},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":183,"vendor_name":184,"vendor_logo":185,"product_slug":186,"product_name":187,"url":188,"description":189},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":191,"vendor_name":192,"vendor_logo":193,"product_slug":194,"product_name":195,"url":196,"description":197},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":200,"title":201,"body":202,"framework_refs":203,"framework_notes":214},"sidecopy-apt-targets-indian-academia-with-spear-phishing-and-reverserat","SideCopy APT Targets Indian Academia with Spear-Phishing and ReverseRAT","The Pakistan-linked APT group SideCopy has expanded its spear-phishing campaigns beyond Indian government targets to now include academic institutions, exploiting the often-weaker security postures found in educational environments. The attacks abuse mshta.exe, a legitimate Windows binary, to execute malicious HTA files delivered via convincing phishing lures — a technique known as 'living off the land' that bypasses many traditional defenses. Once ReverseRAT is deployed, attackers gain persistent remote access and can exfiltrate sensitive research, credentials, and institutional data. This expansion highlights how APT groups deliberately pivot to softer targets within a nation's critical ecosystem when primary targets harden their defenses.",[204,205,206,207,208,209,210,211,212,213],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1218.005 – System Binary Proxy Execution: Mshta","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment",{}]