SideCopy APT Targets Indian Academia with ReverseRAT via Spear-Phishing
The Pakistan-linked SideCopy APT group has expanded its targeting to Indian academic institutions, employing sophisticated spear-phishing campaigns to deploy the ReverseRAT malware.
The advanced persistent threat (APT) group known as SideCopy, believed to be originating from Pakistan and sharing ties with Transparent Tribe, has broadened its operational scope to include academic institutions in India. Historically focused on Indian defense and government entities, this shift indicates an evolving strategic interest in the education sector for intelligence gathering.
The latest campaign documented by Trellix researchers utilizes a multi-stage spear-phishing attack chain. It begins with a weaponized ZIP archive containing a Windows shortcut (LNK) file. This LNK file is designed to appear legitimate, often with a spoofed PDF icon and a .DOCX extension, to trick recipients into executing it. Upon execution, the LNK file fetches an obfuscated HTML Application (HTA) file from a remote server.
This HTA file is then executed using the legitimate Windows utility mshta.exe. The malware employs an anti-forensic technique, deleting the HTA file after the next stage of the infection is initialized. The HTA payload contains a complex, multi-stage deobfuscation routine that reconstructs a two-part XAML payload directly in memory. This payload is responsible for reflectively loading a dynamic-link library (DLL).
To evade disk-based detection, the core payload is decoded and loaded into the system's volatile memory. This is achieved through .NET deserialization, allowing the malware to operate without writing its primary components to the hard drive. The loaded DLL is identified as ReverseRAT, a remote access trojan that SideCopy has been employing since early 2021.
ReverseRAT is a versatile tool capable of a wide range of malicious activities. It can gather sensitive system metadata, including a list of installed software, screenshots, and stored passwords. The malware can also perform file operations, execute arbitrary commands, establish persistence through Windows Registry modifications, upload files to attacker-controlled servers, and spawn interactive shell sessions.
Command-and-control (C2) traffic generated by ReverseRAT is encrypted using a hard-coded cryptographic key. The exfiltrated data is sent over port 5863 to a domain named dns.educationportals[.]biz, which resolves to the IP address 45.61.157[.]22. This infrastructure appears tailored to blend in with academic network traffic.
The SideCopy group's current activities highlight a disciplined and strategic approach to intelligence collection. Their consistent refinement of infection vectors, particularly the heavy abuse of mshta.exe and sophisticated multilayered obfuscation techniques, demonstrates their adaptability and persistence as a significant threat actor in the region.