SideCopy Expands Targeting to Indian Academia

SideCopy, a threat actor that has spent years focused on Indian government and defense personnel, has broadened its target list to include academic institutions in the country. Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C documented the campaign in a technical report, describing a spear-phishing chain that abuses a legitimate Windows component to stage a remote access trojan.

A Staged Phishing Chain

The campaign begins with a weaponized ZIP archive delivered by email. Inside sits a Windows shortcut file engineered to look harmless: it carries a PDF icon but a .DOCX extension, appearing in the archive as commskll.docx.lnk. The shortcut is the entry point for everything that follows.

When launched, the LNK file reaches out to a remote server at docsportal[.]in to retrieve an obfuscated HTML Application (HTA). That script is executed through mshta.exe, the Windows utility that runs HTML Applications, and it in turn reflectively loads a DLL payload. The malware includes a self-deletion routine that removes the HTA file once the next stage has been initialized.

Inside the Dropper

The DLL functions as a dropper for three embedded components:

• appT.bat, a batch script launched through a Windows Registry Run Key that executes startT.hta via mshta.exe without user interaction
• startT.hta, a secondary stage carrying the obfuscated final payload
• commskl.docx, a decoy document

Trellix described the obfuscated code inside startT.hta as running a multi-stage deobfuscation routine that reconstructs a two-part XAML payload directly in memory, and said it is responsible for reflectively loading an embedded DLL named ioluegnt.dll.

Payload Assembled in Memory

The core payload does not land on disk. Trellix said the malware decodes it into volatile memory, moving from a Base64-encoded string to an active in-memory process through .NET Deserialization. The technique is aimed at evading disk-based detection, since the code only takes shape inside process memory.

The loaded DLL is ReverseRAT, a trojan the group has deployed since early 2021 for data exfiltration, remote execution, and persistence. Its capabilities include gathering system metadata, a list of installed software, screenshots, passwords, and clipboard content; performing file operations; running commands; establishing persistence through the Registry; uploading files; and spawning a shell session.

Command and Control

Trellix said the command-and-control traffic is encrypted with a hard-coded cryptographic key: NMXIKS09?:709,!~lnsYUS. Harvested data is exfiltrated over port 5863 to dns.educationportals[.]biz, which resolves to the IP address 45.61.157[.]22.

Who SideCopy Is

SideCopy, also tracked as TAG-140, has been active since at least 2019. The group originates from Pakistan and shares overlaps with the Transparent Tribe cluster. Its historical targeting has centered on Indian defense forces and government officials.

The group has not confined itself to India. In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.

The Researchers' Assessment

Trellix summarized the campaign's delivery mechanics in its report, and described the group's broader approach in its conclusion.

"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said in a technical report. "This delivery mechanism facilitates the deployment of a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure."

— Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C

The report's conclusion states: "The current activities of SideCopy underscore a disciplined and highly strategic approach to intelligence collection," adding that while their historical focus has been on Indian government entities, "their recent pivot toward academic institutions highlights an expanding set of strategic priorities."

The researchers also wrote that by continuously refining their infection stages, most notably through the heavy abuse of mshta.exe and complex, multilayered obfuscation, "they remain a formidable and adaptive adversary for regional security."

The Numbers Behind the Chain

• SideCopy has been active since at least 2019
• ReverseRAT has been used by the group since early 2021
• Exfiltration runs over port 5863
• C2 domain: dns.educationportals[.]biz, resolving to 45.61.157[.]22
• Initial payload server: docsportal[.]in
• Seqrite Labs linked the group to an Afghanistan Ministry of Finance campaign in June 2026

Why It Matters

The shift toward academic institutions means universities and research bodies in India may now sit inside SideCopy's target set. The group's techniques rely on trusted Windows components and user habits rather than unpatched software flaws, which suggests organizations focused only on patching may not be fully covered.

Restricting or monitoring mshta.exe execution, treating shortcut files as potentially hostile regardless of their displayed icon, and watching for Registry Run Key additions that launch script hosts are measures that map directly onto the stages Trellix documented. Detection efforts aimed at a single stage — the phishing email, or the dropped file — may miss the rest of the sequence, since each step is designed to hand off to the next with minimal disk footprint and minimal user awareness.

For readers at institutions that fit the profile, the practical value of the report may lie less in the novelty of any single technique than in the composition of the whole chain. The use of a legitimate Windows binary and in-memory payload assembly suggests that defenders who rely primarily on disk-based tools could face a gap, while those watching process behavior and script execution may have more to work with.