The threat actor known as SideCopy has expanded its espionage operations to target academic institutions in India, moving beyond its traditional focus on government entities, according to a technical report published by Trellix in September 2026. Researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C documented the shift, noting that the Pakistan-based advanced persistent threat group has been active since at least 2019. The campaign uses spear-phishing emails to deliver remote access trojans capable of stealing passwords, screenshots, and system data from compromised machines.
The attack chain begins with a weaponized ZIP archive containing a Windows shortcut file disguised with a spoofed PDF icon and a .DOCX extension labeled "commskll.docx.lnk." That shortcut fetches an obfuscated HTML Application from a remote server at "docsportal[.]in" and runs it through mshta.exe, which then reflectively loads a DLL payload into memory. The malware employs an anti-forensic self-deletion routine that erases the HTA file once the next stage launches. The DLL drops three embedded components: a batch script launched via Windows Registry Run Key, a secondary exploit stage containing the obfuscated final payload, and a decoy document. The final payload is a remote access trojan named ReverseRAT, which SideCopy has deployed since early 2021 to enable data theft, remote command execution, and persistence on victim systems. The trojan collects system metadata, installed software lists, screenshots, passwords, and clipboard content, while also performing file operations, running commands, establishing Registry-based persistence, uploading files, and spawning shell sessions. Stolen data is encrypted using a hard-coded cryptographic key and exfiltrated via port 5863 to "dns.educationportals[.]biz," which resolves to IP address "45.61.157[.]22."
The Trellix report states that SideCopy campaign operations "typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols." The researchers explain that this delivery mechanism "facilitates the deployment of a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure." The group, also tracked as TAG-140, originates from Pakistan and shares overlaps with the Transparent Tribe cluster, having historically targeted Indian defense forces and government officials. In June 2026, Seqrite Labs linked SideCopy to a separate spear-phishing campaign against Afghanistan's Ministry of Finance using an open-source remote access trojan called Xeno RAT.
The pivot toward academic institutions reflects a broadening of strategic priorities for the threat actor, according to the analysis. The malware's multi-stage deobfuscation routine reconstructs a two-part XAML payload directly in memory, allowing it to evade disk-based detection by decoding its core payload into volatile memory space and transitioning from a Base64-encoded string to an active, in-memory process via .NET Deserialization. This approach allows the trojan to operate without leaving artifacts on disk that traditional antivirus tools might flag. Trellix researchers concluded that "the current activities of SideCopy underscore a disciplined and highly strategic approach to intelligence collection," adding that the group remains "a formidable and adaptive adversary for regional security" through continuous refinement of infection stages and heavy abuse of mshta.exe combined with complex, multilayered obfuscation.
The report indicates that while SideCopy's historical focus on Indian government entities continues, the recent shift toward universities highlights an expanding set of intelligence-gathering objectives. The group's ability to continuously adapt its tactics, particularly through in-memory payload execution and Registry-based persistence mechanisms, suggests sustained investment in operational security and evasion capabilities. Defenders protecting academic and government networks in the region will need to anticipate adversaries who prioritize stealth over volume, investing in lateral thinking rather than simply tightening the same perimeter controls that phishing campaigns are explicitly designed to bypass.