Full Report
The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers
Analysis Summary
# Threat Actor: SideCopy
## Attribution & Identity
* **Actor Name:** SideCopy
* **Aliases:** None mentioned in the text (Note: Historically linked by industry researchers to Transparent Tribe/APT36).
* **Known Associations:** The actor is known for mimicking the tactics and tools of the Sidewinder APT, which is the origin of its name ("Side-Copy").
## Activity Summary
Recent operations involve a strategic expansion of targeting. The actor is currently leveraging spear-phishing lures to compromise academic institutions, marking a shift from their traditional focus on government and military entities. The campaign utilizes the abuse of legitimate Windows utilities to bypass security controls.
## Tactics, Techniques & Procedures
* **Initial Access:** Spear-phishing campaigns using malicious lures.
* **Execution:** Abuse of `mshta.exe` to execute malicious scripts (T1218.005).
* **Defense Evasion:** Leveraging legitimate binaries (Living off the Land) to circumvent standard security protocols and detection engines.
## Targeting
* **Sectors:** Academic institutions, Government entities.
* **Geography:** India.
* **Victims:** Specifically targeted academic researchers and institutional personnel in India.
## Tools & Infrastructure
* **Malware families used:** Malicious scripts executed via HTA files.
* **Infrastructure:** Not explicitly detailed in the provided snippet beyond the use of spear-phishing lures.
## Implications
SideCopy is actively diversifying its target profile within India. By expanding from government targets to academia, the actor likely seeks to gather intellectual property, research data, or establish a foothold in networks that may have less stringent security posture than high-level government agencies. The continued use of `mshta.exe` demonstrates the effectiveness of basic living-off-the-land techniques against current defense deployments.
## Mitigations
* **Endpoint Security:** Implement execution prevention rules to block or audit the use of `mshta.exe`, especially when called by web browsers or email clients.
* **Email Filtering:** Strengthen spear-phishing defenses by inspecting attachments for HTA files and suspicious scripts.
* **Behavioral Monitoring:** Monitor for unusual parent-child process relationships (e.g., `outlook.exe` or `chrome.exe` spawning `mshta.exe`).
* **User Training:** Conduct specialized phishing awareness training for academic staff, emphasizing the risks of opening unexpected attachments even if they appear to be relevant to their research field.