Talk to an expert
ProductsSolutionsTrustPricingNewsTalk to an expert
Back to Newsroom
Threat Intel

SideCopy Widens Spear-Phishing Campaign to Target Indian Academic Institutions

A Pakistan-linked APT known as SideCopy is now targeting Indian universities with spear-phishing emails that deliver the ReverseRAT trojan through a stealthy, largely fileless infection chain.

4T4Tify Team4Tify
Sep 22, 2026·4 min read
SideCopy Widens Spear-Phishing Campaign to Target Indian Academic Institutions

SideCopy Widens Its Spear-Phishing Net to Indian Universities

A Pakistan-linked advanced persistent threat group known as SideCopy — also tracked as TAG-140, and long associated with the broader Transparent Tribe activity cluster — has begun targeting academic institutions in India, a departure from its historical focus on government and defense targets.

What happened

According to newly published research, SideCopy's latest campaign starts with a spear-phishing email carrying a ZIP archive. Inside is a Windows shortcut file disguised with a double extension and a spoofed document icon, designed to look like an ordinary Word or PDF file. Opening it silently triggers a chain of steps: a hidden script pulls down an obfuscated HTML Application from a remote server, which in turn uses Windows' built-in mshta.exe utility to reflectively load a malicious DLL directly into memory — skipping disk-based antivirus checks almost entirely.

That DLL drops three components on the victim's machine: a batch script that re-launches the infection chain via a Registry Run key on every login (for persistence without user interaction), a secondary obfuscated payload, and a decoy Word document shown to the victim to avoid suspicion. The final stage decodes and loads directly in memory — again via a .NET deserialization trick — a fully-featured remote access trojan known as ReverseRAT, which SideCopy has used since at least 2021.

Once installed, ReverseRAT can harvest system information, list installed software, take screenshots, steal saved passwords and clipboard contents, upload and download files, run arbitrary commands, and open an interactive remote shell — all communicated back to attacker-controlled infrastructure over an encrypted channel.

Why it matters

SideCopy has historically concentrated on Indian defense and government targets. Its pivot toward universities and research institutions suggests a broadening of intelligence-collection priorities — and a reminder that academic networks, often less hardened than government ones, are an attractive stepping stone for espionage-motivated actors. The campaign also underlines a wider trend: attackers increasingly favor in-memory, fileless execution techniques specifically to defeat traditional antivirus and EDR tooling that relies on scanning files written to disk.

What to do

  • Treat unsolicited ZIP attachments containing shortcut (.lnk) files as high-risk, especially when the visible filename uses a double extension (e.g. "document.docx.lnk").
  • Restrict or monitor mshta.exe execution via application allow-listing — most organizations have no legitimate business need for it to run unprompted from user-writable directories.
  • Audit Registry Run keys regularly for unexpected entries, a classic low-effort persistence mechanism.
  • Deploy endpoint detection that inspects in-memory behavior (reflective DLL loading, .NET deserialization abuse) rather than relying solely on disk-based signature scanning.
  • Segment and monitor academic/research networks with the same rigor applied to government-facing systems, particularly where they interconnect with sensitive partners.
SHARE
4Tify — SideCopy APT Targets Indian Academia With ReverseRAT