SideCopy, a Pakistan-linked advanced persistent threat (APT) long tied to attacks on Indian government and defense entities, has notably shifted its phishing campaign to target academic institutions in India. New findings from cybersecurity firm Trellix reveal that spear-phishing emails—once reserved largely for governmental targets—are increasingly being used to compromise universities and research organizations.
How the new campaign works
The attack begins with spear-phishing emails designed to trick recipients into downloading a ZIP archive. Inside this archive is a deceptively innocuous-looking Windows shortcut file (.LNK) masquerading as a Word document but with a spoofed PDF icon. The LNK file contacts a malicious remote server to download an HTML Application (HTA), which is then launched using mshta.exe. Following execution, a DLL payload is loaded reflectively, and the HTA deletes itself in a bid to avoid forensic detection.
That DLL functions as a dropper for three hidden components: appT.bat, which uses a registry run key to execute a secondary HTA stage automatically; startT.hta, an obfuscated stage that includes the final payload; and a fake document file commskll.docx. The startT.hta script undertakes a complex deobfuscation routine to build a two-part XAML payload in memory. The embedded DLL—called ioluegnt.dll—is executed using these in-memory tricks so it never touches disk directly, decoding from a Base64 string and relying on .NET serialization to go undetected.
What ReverseRAT is capable of
ReverseRAT is the malware at the heart of this operation. Introduced into SideCopy’s toolset since early 2021, it offers a full suite of spy capabilities: gathering system and software data, capturing screenshots, stealing credentials, harvesting clipboard contents, performing file operations, executing shell commands, maintaining persistence via registry tweaks, and uploading exfiltrated data. All communications with its command-and-control (C2) server are encrypted using a fixed key, and data is exfiltrated through a specified port to a server masquerading under a seemingly benign domain name—”dns.educationportals[.]biz”—linked to an IP address tracing back to the attacker.
Shifting focus to academia
SideCopy, active since around 2019, has been regularly linked with the Transparent Tribe cluster and historically prioritized government, military, and defense targets in India. But as of mid-2026, it has extended efforts into the education sector—a turning point that signals broader ambitions in its intelligence-gathering strategy.
Previous operations by the group included a campaign against Afghanistan’s Ministry of Finance using an open-source variant of ReverseRAT, dubbed Xeno RAT. The most recent attacks on Indian academic organizations show both technical advancement—multi-staged obfuscation, in-memory payloads, self-deletion of artifacts—and strategic escalation.
For academic institutions in India, this evolution poses a critical threat. The tools and code used by SideCopy are not just stealthy, but built for persistence and remote control. Reputations, intellectual property, student data—all are at stake.
Analytical Take: SideCopy’s pivot toward academia reflects a growing trend in cyber-espionage where universities become attractive soft targets: rich in research data yet often less protected than government networks. The use of ReverseRAT and complex, layered delivery mechanisms shows SideCopy’s ability to adapt and refine their methods. Going forward, stronger email filtering, behavior-based detection, and awareness training in academic environments will be essential defenses. What to watch: how widespread these attacks become, and whether tools like ReverseRAT evolve or diversify even further to target new sectors.
