SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

The threat actor SideCopy is now targeting academic institutions in India using spear-phishing tactics, marking an expansion of their focus beyond government entities. SideCopy's campaigns typically start with spear-phishing efforts that exploit mshta.exe to run malicious scripts and evade standard security measures. This approach allows them to circumvent usual security protocols. Researchers at Trellix have observed this activity, highlighting the group's evolving targeting strategy. SideCopy's shift to targeting academia in India indicates a broadening of their objectives. The use of spear-phishing and exploitation of mshta.exe is a key part of their operational methodology.