Indian Authorities Warn of SideCopy Hackers Targeting Organizations with Spear-Phishing Attacks
Indian authorities have recently issued an advisory cautioning that the infamous SideCopy hackers are actively targeting Indian organizations, particularly academic institutions, through sophisticated spear-phishing attacks that deploy a type of malware known as ReverseRAT on Windows systems. This warning, released on October 15, 2026, categorizes the threat as medium severity, highlighting the potential risks posed by this malware, which can steal sensitive information, capture screenshots, and compromise passwords.
SideCopy hackers have tailored their campaign to utilize deceptive attachments and malicious Windows shortcuts along with carefully crafted obfuscated scripts. By leveraging legitimate operating system utilities, they create a façade that can easily mislead users into executing harmful actions unknowingly.
As detailed by Trellix researchers, the infection process follows a multistage chain that allows the malware to establish persistence on targeted devices before the remote access Trojan is loaded into memory. This characteristic complicates detection efforts, often thwarting conventional file-scanning methods.
The intrusion typically commences with a phishing email containing a weaponized ZIP archive. Inside this archive lies a malicious LNK shortcut, which masquerades itself as an innocuous document—often with a misleading name and a spoofed PDF icon. This clever ruse encourages unsuspecting recipients to click and run the shortcut, thereby initiating the attack.
Upon execution, the shortcut retrieves an obfuscated HTML Application (HTA) from attacker-controlled infrastructure, specifically from a site identified as docsportal[.]in. Notably, Windows executes this script via mshta.exe, employing a legitimate system utility as an execution host to bypass typical security measures.
Within the HTA file, a DLL named ne4snapk.dll is embedded. This vital component loads into the mshta.exe process using .NET deserialization techniques. Classified as a dropper, this DLL extracts three compressed components: appT.bat, startT.hta, and a decoy document called commskl.docx. While the document serves as a distraction, the other scripts continue to propel the infection forward.
The persistence mechanism established by this malware relies on a Windows Registry Run key, which is configured to launch appT.bat whenever the affected user signs in. The batch script subsequently initiates mshta.exe to execute startT.hta in the background, thereby enabling the malware to remain active without requiring further phishing interactions.
Subsequently, the secondary HTA reconstructs its obfuscated payload and reflectively loads ioluegnt.dll, identified by Trellix as ReverseRAT. This process employs .NET deserialization once again to convert encoded content into an active, in-memory payload.
Though the execution phase of this attack minimizes exposure to disk-based scanning through its reliance on memory usage, the overall intrusion still generates scripts and other artifacts that facilitate detection. Therefore, it is characterized as a staged infection with an in-memory payload, rather than constituting an entirely fileless attack.
The capabilities of ReverseRAT are extensive, enabling attackers to collect system metadata, details about installed software, screenshots, and even clipboard contents. Furthermore, operators can execute commands, manipulate files, upload additional malware, and initiate shell sessions, granting them significant access to compromised endpoints.
Reported command-and-control infrastructure associated with this attack includes dns[.]educationportals[.]biz, utilizing TCP port 5863 for communications. To ensure confidentiality, the malware employs a hardcoded cryptographic key that safeguards command-and-control traffic along with any stolen data.
In response to this alarming threat, defenders are urged to closely monitor unusual mshta.exe activity, particularly connections to suspicious external infrastructure followed by script execution and unexpected changes in the Windows Registry. By correlating these behaviors, security teams can more effectively unveil the infection chain, rather than relying solely on analysis of individual filenames.
Organizations are advised to bolster their email filtering protocols, restrict the execution of potentially malicious shortcuts, and implement behavioral detection mechanisms. If suspected infections are identified, it is crucial to preserve evidence and activate incident response measures, as the surveillance and data-theft capabilities of ReverseRAT present immediate risks related to data exposure.
In light of the increasing sophistication of cyber threats, it is more important than ever for organizations to remain vigilant and proactive to safeguard their data and maintain the integrity of their systems.