SideCopy Expanding Spear-Phishing to Indian Academia

SideCopy (also known as TAG-140), a Pakistan-linked threat actor with ties to Transparent Tribe, has shifted its strategic focus to include academic institutions in India, alongside its traditional government and defense targets. The campaign utilizes highly social-engineered spear-phishing lures, such as deceptive PDF/DOCX-themed LNK files, to initiate a multi-stage infection chain.

The attack is notable for its heavy reliance on Living-off-the-Land (LotL) techniques, specifically abusing mshta.exe to execute remote scripts and reflectively load payloads. The campaign culminates in the deployment of ReverseRAT, a remote access trojan capable of full system compromise, using .NET BinaryFormatter deserialization to remain fileless and evade disk-based detection.

This shift toward academia indicates an expansion of SideCopy's intelligence requirements and demonstrates their continued refinement of evasive execution methods. Organizations in the Indian region should prioritize monitoring for anomalous mshta.exe behavior and non-standard outbound network traffic.