SideCopy (TAG-140)
Suspected Pakistan-linked espionage group, tied by vendors to Transparent Tribe, that mimics SideWinder's tradecraft to phish Indian defense, government and Afghan officials.
- Active
- 2019 to September 2026
- Origin
- Pakistan (vendor assessment; no government attribution)
- Affiliates
- Transparent Tribe / APT36 (sub-division or affiliate per Seqrite, Recorded Future; overlap per Cisco Talos), TAG-140 (Recorded Future, overlapping cluster), RusticWeb (overlaps reported by Seqrite), SideWinder (infection chain imitated, not affiliated)
- Regions targeted
- India, Afghanistan, Pakistan
- MITRE ATT&CK
- G1008
Profile
SideCopy is a South Asian espionage group that has been phishing Indian defense and government staff since at least early 2019, and Afghan officials alongside them. Quick Heal’s Seqrite team named it in a 2020 white paper called Operation SideCopy, published in September 2020 according to The Hacker News. The name is the point: Seqrite found the actor copying the infection chain of SideWinder, a suspected Indian group, in a way that steered analysts toward the wrong suspect. Seqrite subtitled its paper as an insight into a Transparent Tribe sub-division “incorrectly attributed for years.” ThreatRoundup profiles the group it was imitating on its SideWinder page.
Attribution to Pakistan is a vendor assessment, not a government finding. MITRE ATT&CK calls SideCopy a Pakistani threat group. Lumen’s Black Lotus Labs assessed in 2021 that the operator was very likely operating out of Pakistan, based on its telemetry. Team Cymru traced the management of SideCopy’s Action RAT servers to 17 Pakistani mobile IP addresses keeping a Monday-to-Saturday working week, plus a few Proton VPN nodes. Recorded Future’s Insikt Group tracks an overlapping cluster as TAG-140 and calls SideCopy a suspected Pakistani state-aligned group. Meta, which removed SideCopy accounts in 2021, described the hackers as from Pakistan while noting the operation tried to obscure who was behind it.
The link to Transparent Tribe (APT36), which ThreatRoundup does not yet profile, is the other open question. Seqrite treats SideCopy as a Transparent Tribe sub-division and has pointed to shared hosting, decoys and code: in 2023 it found SideCopy’s Linux stager following the same flow as APT36’s Poseidon agent, and in 2024 an open directory serving both groups’ payloads from one domain. In 2025 Seqrite described a division of labor, with APT36 mostly on Linux and SideCopy mostly on Windows (The Hacker News). Cisco Talos saw close similarities in themes and tactics, Recorded Future calls SideCopy a sub-cluster or operational affiliate, and Malwarebytes, Cyble and Fortinet repeat the subdivision idea as something others have reported. Treat it as a strong, widely shared vendor view rather than a proven identity.
The delivery chain is recognizable and has changed slowly. A spearphishing email or link (T1566.001 (Phishing: Spearphishing Attachment)) brings a ZIP holding a shortcut file disguised as a PDF, image or slide deck (T1036.007 (Masquerading: Double File Extension)). Opening it (T1204.002 (User Execution: Malicious File)) runs mshta.exe against a remote HTA (T1218.005 (System Binary Proxy Execution: Mshta)), often hosted on a hacked Indian or Afghan website (T1584.001 (Compromise Infrastructure: Domains)), including an Indian water ministry project site and what Securonix calls a likely compromised Delhi income tax site. A .NET loader checks which antivirus is installed (T1518.001 (Software Discovery: Security Software Discovery)), copies a legitimate Windows binary such as credwiz.exe into a new folder and side-loads a malicious DUser.dll beside it (T1574.001 (Hijack Execution Flow: DLL)), with a Run key for persistence (T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)). Lures follow Indian defense news closely: DRDO missile projects, armed forces allowance orders, National Defence College schedules, think-tank job offers and honeytraps.
What changes is the payload. Talos counted a burst of new RATs in 2021 (CetaRAT, DetaRAT, ReverseRAT, MargulasRAT, ActionRAT) next to commodity tools such as AllaKore and njRAT, and according to The Hacker News’ summary, some droppers posed as installers for Kavach, the two-factor authentication app Indian government staff use for email. Securonix later found a RAT that looked specifically for the Kavach database file. Since 2023 the group has leaned on open-source RATs (Ares on Linux, Xeno RAT, Spark RAT) plus home-grown CurlBack and DRAT. It exploited the WinRAR flaw CVE-2023-38831 in 2023, swapped HTA files for MSI installers in late 2024 (Seqrite), and in 2025 used a ClickFix trick on a cloned Indian Ministry of Defence press portal (T1204.004 (User Execution: Malicious Copy and Paste)). Meta also found an Android track in 2021, with fake young women luring Afghan officials into trojanized chat apps carrying PJobRAT and a strain Meta called Mayhem.
Targeting has widened from soldiers to the wider state. Early reports describe only Indian defense forces and armed forces personnel. By 2021 the list included Indian power utilities and, per Malwarebytes, Afghan ministries and the presidential administration office, where it stole government portal and banking credentials. Since 2024 Seqrite has reported shipyards and ports, the Indian Air Force, railways, oil and gas, the Ministry of External Affairs and municipal corporations in Maharashtra, whose staff login portals were copied for credential phishing. In 2026 Seqrite tied a Xeno RAT campaign against Afghanistan’s finance ministry to SideCopy, and The Hacker News reported Trellix research showing a turn toward Indian universities.
Events
| Date | Target | Narrative | Source | Our coverage |
|---|---|---|---|---|
| 2026-09 | Academic institutions in India | Trellix reports a spearphishing ZIP holding a shortcut with a fake .docx extension and PDF icon. It runs an obfuscated HTA through mshta.exe, which reflectively loads a DLL (T1620 (Reflective Code Loading)), deletes itself, sets a Run key and finally runs ReverseRAT in memory. | The Hacker News (on Trellix) | |
| 2026-05 | Afghanistan’s Ministry of Finance and provincial revenue and finance directorates | Operation XENOFISCAL: a ZIP with a Pashto-named shortcut runs mshta.exe against a script on a compromised Afghan education domain, loading Xeno RAT 1.8.7 and showing a decoy ministry staff directory. Persistence via a Run key named to look like Microsoft Edge. Seqrite attributes it to SideCopy with medium-to-high confidence. | Seqrite | |
| 2025-06 | Indian government, defense and rail sectors | A cloned Ministry of Defence press release portal serves a ClickFix lure: the victim is told to paste a command that runs mshta.exe, which installs the BroaderAspect loader and then DRAT V2, a Delphi rewrite of the earlier .NET DRAT. Recorded Future attributes it to TAG-140 with moderate confidence. | Recorded Future | |
| 2024-12 to 2025-02 | Indian railways, oil and gas, external affairs and defence staff; Maharashtra municipal corporations; students | Lures include a Southern Railway holiday list, HPCL “cybersecurity guidelines” and a National Defence College schedule. A new MSI chain side-loads CurlBack RAT; a parallel HTA chain loads a custom Xeno RAT; Linux victims get Spark RAT. Payloads were staged on the compromised National Hydrology Project site of India’s water ministry, and fake municipal login pages harvested credentials (T1598.003 (Phishing for Information: Spearphishing Link)). | Seqrite | |
| 2024-07 | Indian Air Force, shipyards and ports | Decoys about Air Force pay and port and shipyard contracts deliver ReverseRAT, Action RAT (side-loaded by charmap.exe) and a new .NET Geta RAT. Seqrite found SideCopy HTA stagers hidden on the same domain that hosted Transparent Tribe’s Linux malware. | Seqrite | |
| 2023-04 to 2023-10 | Indian government and defense entities | Archives exploit the WinRAR flaw CVE-2023-38831 (T1203 (Exploitation for Client Execution)) to drop AllaKore RAT, DRat and Key RAT, while a Golang Linux stager installs an Ares RAT agent with cron persistence (T1053.003 (Scheduled Task/Job: Cron)). Lures referenced the Ministry of Defence and a Saudi defence delegation. | Seqrite | |
| 2023-05 | Indian defense research | A ZIP themed on DRDO, the K-4 missile and a clean room holds a shortcut posing as a PowerPoint file. HTA stages generated with SILENTTRINITY drop a RAT that a renamed credwiz.exe side-loads, with a Run key named “Windows Update Schedule.” | Fortinet | |
| 2023-04 | Victims in India | Team Cymru counts 18 distinct Indian victims talking to Action RAT servers and 236 talking to AllaKore RAT servers, and traces server management to Pakistani mobile IP addresses and Proton VPN. | Team Cymru | |
| 2023-03 | India’s Defence Research and Development Organisation (DRDO) | A missile-themed shortcut fetches an HTA that shows a decoy deck, side-loads Action RAT through a copied credwiz.exe and deploys a newly described AuTo Stealer that exfiltrates Office files, PDFs and images. | Cyble | |
| 2023-02 | Indian government entities | A macro-enabled “Cyber Advisory 2023” Word document, posing as Ministry of Communications guidance on Android threats, installs ReverseRAT. Attributed by ThreatMon. | The Hacker News (on ThreatMon) | |
| 2022-12 | Indian government employees using Kavach two-factor authentication | STEPPY#KAVACH: a shortcut posing as an image runs a remote HTA hosted on a likely compromised Delhi income tax website. A small C# RAT takes screenshots, runs commands and exfiltrates files, including the Kavach database if present. Securonix ties it to SideCopy on shared tradecraft. | Securonix | |
| 2021-04 to 2021-08 | People linked to the former Afghan government, military and police in Kabul | Fake personas of young women used romance lures to push phishing links and trojanized chat apps (HappyChat, HangOn, TeleChat and others, some posing as Viber and Signal) carrying PJobRAT and a new Android strain Meta calls Mayhem. Compromised websites hosted Facebook credential phishing. Meta removed the network in August 2021. | Meta | |
| 2021 (reported 2021-12) | Afghanistan’s presidential administration office, foreign and finance ministries and National Procurement Authority; Indian defense personnel | ZIPs with shortcuts, Publisher macros or a trojanized 3D viewer lead to mshta and side-loaded ActionRAT and a new AuTo Stealer. Malwarebytes says ten administration office staff were compromised and credentials for government portals, Maiwand Bank, and email and social accounts were stolen, along with visa and ID records. | Malwarebytes (ThreatDown) | |
| 2021-07 | Indian government personnel | Talos documents several new RAT families (CetaRAT, DetaRAT, ReverseRAT, MargulasRAT, ActionRAT) and plugins for file listing, browser password theft and keylogging (T1056.001 (Input Capture: Keylogging)), with decoys posing as military and think-tank documents and honeytrap lures. | Cisco Talos | |
| 2021-03 to 2021-07 | Indian critical government entities; Army Welfare Education Society lure | Seqrite’s second wave of Operation SideCopy: COVID-19 lures for the first time, a C# implant called ReverseRAT and njRAT backdoors, with servers mostly at Contabo as before. | Seqrite | |
| 2021-03 to 2021-06 | Indian power transmission and generation organizations; a foreign government organization; a few victims in Afghanistan | Links to compromised sites in the victim’s own country deliver a shortcut and decoy PDF (vaccination and energy themes), then a CactusTorch-based HTA and an in-memory loader that install the new ReverseRat alongside AllaKore. Black Lotus Labs linked the chain to Operation SideCopy. | Lumen Black Lotus Labs (archived) | |
| 2019 to 2020 | Indian defence forces and armed forces personnel | Operation SideCopy: shortcuts in RAR or ZIP files, or a Word document using template injection (T1221 (Template Injection)) and an RTF exploiting CVE-2017-11882, lead to mshta, a credwiz.exe side-load of DUser.dll and RAT payloads. Lures copied armed forces allowance orders and defence production policy. Seqrite says the actor copied SideWinder’s techniques. | Seqrite |
Target vectors risk profile
| Government | Defense | Espionage | Diplomatic | Energy | Transportation/logistics | Education/research | Cloud/identity | Mobile devices | Finance | Telecom | Edge devices/VPNs | Ransomware/extortion |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| High | High | High | Medium | Medium | Medium | Medium | Medium | Medium | Low | Low | N/A | N/A |
Malware and tools
| Name | What it does | Public detection | Hunt Leads | Reports |
|---|---|---|---|---|
| ReverseRAT | C# backdoor for reconnaissance, screenshots, credential and clipboard theft, file transfer, commands and reverse shells; in use since 2021 | Indicators in the vendor reports | Lumen, Seqrite, The Hacker News (on Trellix) | |
| Action RAT | Side-loaded Delphi RAT that profiles the host, runs commands and moves files | Indicators in the vendor reports | MITRE ATT&CK, Cyble, Team Cymru | |
| AuTo Stealer | C++ stealer that collects documents, databases and images and sends them over HTTP or TCP | Indicators in the vendor reports | MITRE ATT&CK, Malwarebytes | |
| AllaKore RAT | Open-source Delphi RAT for keylogging, screenshots, file transfer and remote control | Indicators in the vendor reports | Team Cymru, Seqrite | |
| CetaRAT, DetaRAT, MargulasRAT | Custom C# RATs Talos tied to the group in 2021; Securonix’s Kavach-hunting RAT has been called MargulasRAT | Indicators in Talos’s report | Cisco Talos, Securonix | |
| DRat and DRAT V2 | RAT first seen in .NET in 2023, rewritten in Delphi with arbitrary shell command execution | Indicators in Recorded Future’s report | Seqrite, Recorded Future | |
| CurlBack RAT | Side-loaded Windows RAT that registers victims by UUID and uses curl for file transfer | Indicators in Seqrite’s report | Seqrite | |
| Xeno RAT | Open-source C# RAT (customized builds) with keylogging, screenshots, SOCKS5 proxying and webcam and microphone access | Indicators in Seqrite’s reports | Seqrite | |
| Ares RAT (Linux), Spark RAT | Open-source Python and Go RATs dropped on Linux by a Golang stager with cron persistence | Indicators in Seqrite’s reports | Seqrite, Seqrite | |
| Geta RAT | .NET RAT with 30 commands, borrowing browser-theft code from AsyncRAT | Indicators in Seqrite’s report | Seqrite | |
| PreBotHta and BroaderAspect loaders | .NET loaders that check installed antivirus, drop decoys and set up side-loading and persistence | Indicators in the vendor reports | Fortinet, Recorded Future | |
| PJobRAT, Mayhem | Android spyware in trojanized chat apps, collecting contacts, texts, call logs, location and media | None published | Meta |
Reports
Vulnerabilities exploited
| Vulnerability | CVSS | Severity | Publisher | Platform | CISA KEV |
|---|---|---|---|---|---|
| CVE-2023-38831 | 7.8 | High | RARLAB | WinRAR (before 6.23) | Yes |
| CVE-2017-11882 | 7.8 | High | Microsoft | Microsoft Office (Equation Editor) | Yes |
If you’re in their sights
Do this now
- Stop shortcut files from email and downloads. Block or quarantine .lnk files inside ZIP and RAR attachments, show file extensions on staff machines, and alert when a shortcut launches mshta.exe, cmd.exe or msiexec against a remote URL.
- Restrict mshta.exe, and alert on it reaching the internet. Nearly every SideCopy chain since 2019 runs a remote HTA through it, including the 2025 ClickFix lure where staff were told to paste a command themselves.
- Hunt for legitimate Windows binaries such as credwiz.exe, charmap.exe or renamed copies running from ProgramData, Users\Public or other user-writable folders next to a DUser.dll or other unexpected DLL, and for new Run keys or scheduled tasks named after Edge, OneDrive or Windows Update that point there.
- Patch WinRAR to 6.23 or later and Office against CVE-2017-11882. Both bugs are years old and both have been used by this group.
- Treat login pages for government webmail, payroll and two-factor tools reached from a link as suspect, and protect those accounts with phishing-resistant MFA (security keys or passkeys).
Compiled from Seqrite (Quick Heal), Cisco Talos, Lumen Black Lotus Labs, Malwarebytes, Meta, Securonix, Cyble, Team Cymru, Fortinet, Recorded Future, The Hacker News (reporting Trellix and ThreatMon research) and MITRE ATT&CK, plus ThreatRoundup reporting. Last reviewed November 1, 2026.
ATT&CK techniques (16)
Techniques MITRE ATT&CK links to this group from public reporting, grouped by tactic. A technique can sit under more than one tactic.