[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHtOXUUjRlLZ3IaDP4cEbY8TNmEbEtYcg_A6LXcu7CXA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"8a96a387-6dd3-4113-a4ff-bc9c57602881","sidecopy-apt-targets-indian-academia-with-spear-phishing-and-reverserat","b73461dc-23db-45b4-a037-63ae6ae4457a","SideCopy APT Targets Indian Academia with Spear-Phishing and ReverseRAT","The Pakistan-linked APT group SideCopy has expanded its spear-phishing campaigns beyond Indian government targets to now include academic institutions, exploiting the often-weaker security postures found in educational environments. The attacks abuse mshta.exe, a legitimate Windows binary, to execute malicious HTA files delivered via convincing phishing lures — a technique known as 'living off the land' that bypasses many traditional defenses. Once ReverseRAT is deployed, attackers gain persistent remote access and can exfiltrate sensitive research, credentials, and institutional data. This expansion highlights how APT groups deliberately pivot to softer targets within a nation's critical ecosystem when primary targets harden their defenses.","**Immediate Actions:**\n- Block or heavily restrict execution of mshta.exe via application control policies (e.g., Windows Defender Application Control or AppLocker) on all endpoints.\n- Deploy anti-phishing email filtering with sandboxing to inspect and detonate suspicious attachments and links before delivery.\n- Conduct emergency phishing simulation exercises targeting academic staff and students to assess current susceptibility levels.\n\n**Long-Term Improvements:**\n- Establish a mandatory, role-based security awareness training program for all faculty, staff, and students covering spear-phishing recognition.\n- Implement network segmentation to isolate research systems, administrative networks, and student environments from one another.\n- Develop and rehearse an incident response plan specifically tailored to APT intrusion scenarios, including ReverseRAT indicators of compromise.\n\n**Detection Measures:**\n- Enable and centralize logging of mshta.exe process execution events and alert on anomalous parent-child process relationships via a SIEM platform.\n- Deploy endpoint detection and response (EDR) solutions capable of identifying living-off-the-land binary (LOLBin) abuse in real time.\n- Subscribe to threat intelligence feeds covering SideCopy\u002FTAG-140 TTPs and integrate IOCs into perimeter and endpoint defenses.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2 – Inventory and Control of Software Assets","CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-61 – Computer Security Incident Handling Guide","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-6 – Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1218.005 – System Binary Proxy Execution: Mshta","MITRE ATT&CK T1566.001 – Phishing: Spearphishing Attachment",{},"published","2026-09-22T10:21:48.708868+00:00","2026-09-22T10:21:48.603+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fsidecopy-broadens-india-targeting-to.html","sidecopy-broadens-india-targeting-to-academia-with-reverserat-spear-phishing-c8f864","SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[51,55,59],{"slug":52,"name":53,"problem":54},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":56,"name":57,"problem":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":60,"name":61,"problem":62},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]