SideCopy Uses ReverseRAT to Target Indian Academic Institutions
Pakistan-linked threat actor SideCopy has expanded a spear-phishing operation against academic institutions in India, using a multi-stage infection chain to install the ReverseRAT remote access trojan. Trellix reported that the campaign broadens the group’s historical emphasis on Indian defence forces and government officials.
The attack begins with a weaponized ZIP archive containing a Windows shortcut named commskll.docx.lnk. Its spoofed PDF icon and DOCX-style extension are intended to make the file appear legitimate. Opening the shortcut retrieves an obfuscated HTML Application from docsportal[.]in and launches it with the Windows utility mshta.exe.
A layered chain built around mshta.exe
The downloaded HTA reflectively loads a DLL and then deletes itself after the next stage is initialized. Trellix said this anti-forensic routine is designed to remove an artifact from disk while the infection sequence continues.
The DLL acts as a dropper for three embedded components: appT.bat, startT.hta, and a decoy document named commskl.docx. The batch script uses a Windows Registry Run Key to launch startT.hta through mshta.exe without further user interaction, creating persistence for the chain.
Inside the secondary HTA stage, obfuscated code runs a multi-stage deobfuscation process that rebuilds a two-part XAML payload in memory. That payload reflectively loads the embedded DLL ioluegnt.dll. Trellix described a progression from a Base64-encoded string to an active process through .NET deserialization, keeping the core payload in volatile memory rather than writing it to disk.
ReverseRAT capabilities and network indicators
The final payload is ReverseRAT, a remote access trojan SideCopy has used since early 2021. It can collect system metadata and installed-software lists, take screenshots, capture passwords and clipboard content, perform file operations, execute commands, upload files, and create a shell session.
ReverseRAT also supports Registry-based persistence. Its command-and-control communications are encrypted with a hard-coded cryptographic key, while collected data is exfiltrated over port 5863 to dns.educationportals[.]biz, which Trellix said resolves to 45.61.157[.]22.
Why academic organisations should pay attention
SideCopy, also tracked as TAG-140, has been active since at least 2019 and has overlaps with the Transparent Tribe cluster. Seqrite Labs attributed the group to a June 2026 spear-phishing campaign against Afghanistan’s Ministry of Finance that used the open-source Xeno RAT, illustrating the actor’s continuing use of email-led delivery.
For academic IT and security teams, the practical implication is to treat archive-delivered document lures, unexpected LNK files, and suspicious use of mshta.exe as investigation priorities. Monitoring Registry Run Keys, memory-resident execution behaviour, and outbound traffic on port 5863 can help identify elements of this documented chain.