Cybersecurity
SideCopy targets Indian academia with ReverseRAT
Trellix said SideCopy moved part of its spear-phishing activity towards academic institutions in India, using a multi-stage loader chain built around mshta.exe to install ReverseRAT and steal data.
- Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said SideCopy had used spear-phishing lures against academic institutions in India.
- Trellix described SideCopy as active since at least 2019, also known as TAG-140, and said it overlapped with Transparent Tribe and originated from Pakistan.
- The infection chain began with a ZIP archive containing a disguised Windows shortcut that fetched an HTA file from docsportal[.]in and ran it through mshta.exe.
- Trellix said the final payload was ReverseRAT, which SideCopy had used since early 2021 for data theft, remote execution and persistence.
- Seqrite Labs had previously linked SideCopy to a June 2026 spear-phishing campaign against Afghanistan's Ministry of Finance using Xeno RAT.
Trellix researchers said SideCopy had shifted some of its phishing activity towards academic institutions in India. They said the group had previously focused mainly on government targets.
Trellix described SideCopy, also called TAG-140, as active since at least 2019. It said the group was based in Pakistan and had overlaps with Transparent Tribe.
The delivery chain began with a ZIP file that contained a shortcut file made to look like a document. That shortcut retrieved an HTA from docsportal[.]in and launched it with mshta.exe, after which the malware deleted the HTA stage.
Trellix said the later stages reconstructed an in-memory payload and loaded a DLL identified as ReverseRAT. It said the malware had been used since early 2021 to collect system details, files, screenshots, passwords and clipboard contents, then send them out over port 5863 to dns.educationportals[.]biz.
Named in this story
People
- Boggavarapu R S S Srinivas Gupta
- was one of the Trellix researchers quoted
- Ravishankar N C
- was one of the Trellix researchers quoted
Companies
- Trellix
- published the technical report
- Seqrite Labs
- had published an earlier report on SideCopy
Organisations
- SideCopy (aka TAG-140)
- was the threat actor behind the campaign
- Transparent Tribe
- was the cluster Trellix said SideCopy overlapped with
Governments and agencies
- Afghanistan's Ministry of Finance
- was the target in Seqrite Labs' June 2026 report
Products and systems
- ReverseRAT
- was the remote access trojan Trellix identified
- mshta.exe
- was used to launch the malicious script stages
- Xeno RAT
- was named in Seqrite Labs' earlier attribution
Places
- India
- was the country whose academic institutions were targeted
- Pakistan
- was the country Trellix said SideCopy originated from
- Afghanistan
- was the country named in the earlier campaign
How the source tells it
The article was mainly a technical report, with brief threat-heavy framing in the closing assessment.
- alarm the quoted conclusion used evaluative language to portray the group as a serious adversary
- threat inflation the report widened a technical infection chain into claims about intelligence collection and regional security