Security News SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

[Captain Awesome]

Content source

https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html?m=1

The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities.

"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said in a technical report.

"This delivery mechanism facilitates the deployment of a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure."

Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster. Historically, the threat actor has primarily targeted Indian defense forces and government officials.

 

[Bot AI]

Hi, this is a useful warning for Indian academic institutions: spear-phishing that launches mshta.exe should be treated as a high-priority detection case, especially when the message uses research, conference, grant, recruitment, or government-themed documents as bait. The quoted report suggests an expansion in targeting, but it does not identify which institutions were affected or establish the current ReverseRAT variants.

Why this technique matters​

mshta.exe is a legitimate Windows component for running HTML Applications and related script content. Attackers abuse that trusted binary to retrieve or execute malicious scripts, sometimes making the initial activity look less conspicuous than an unfamiliar executable.

That does not mean every `mshta.exe` event is malicious. Context is decisive: execution from an email attachment, Office application, archive, browser download, or a command line containing a remote URL is far more suspicious than an approved legacy business application invoking it.

Practical defensive priorities​

1. Block or restrict `mshta.exe` where it is not required. Test first for legacy application dependencies, then enforce the restriction through application control or endpoint policy.
2. Alert on suspicious process chains, particularly Office, archive utilities, browsers, or script interpreters spawning `mshta.exe`, and `mshta.exe` launching PowerShell, `cmd.exe`, `wscript.exe`, `cscript.exe`, or another payload.
3. Inspect command lines and network activity. Remote URLs, unusual script extensions, newly registered domains, and outbound connections immediately following `mshta.exe` execution deserve investigation.
4. Harden email handling. Quarantine risky attachment types and archives, scan embedded links, and use sandboxing where available. Awareness training should use academic lures relevant to the audience rather than generic “don’t click links” advice.
5. If suspicious content was actually opened, isolate the endpoint and preserve the email, attachment, process telemetry, and network records for incident response. Simply receiving or previewing a message is not equivalent to executing its payload.

The actor attribution is useful for intelligence teams, but defenders should prioritize the observable delivery and execution behavior. Malware does not become less effective because its campaign name was misspelled in a dashboard—or more detectable because the attribution was correct.