SideCopy expands India targeting to academia with ReverseRAT spear-phishing

SideCopy is targeting Indian academic institutions with ReverseRAT spear-phishing in a new campaign disclosed today by The Hacker News. The shift expands the group’s focus beyond government entities and heightens risks to research data and campus networks. It marks a strategic broadening of SideCopy’s target set in India, raising urgency for academic defenders.

"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers said, as cited by The Hacker News. The Hacker News reports the lures deliver ReverseRAT as the payload, enabling remote access once a user is tricked into opening the bait. Watch for indicators of compromise from Trellix, potential advisories from CERT-In, and confirmation from targeted universities. [Developing. This article will be updated.]