Key points
- SideCopy hackers target Indian organisations with spear-phishing attacks deploying ReverseRAT on Windows systems.
- The malware steals passwords, captures screenshots, and collects sensitive information from compromised endpoints.
- Indian authorities issued an advisory on 15 October 2026 classifying the threat as medium severity.
The SideCopy threat group has launched a campaign against Indian organisations, including academic institutions, to steal sensitive data. According to GBHackers, these attackers deploy ReverseRAT malware on Windows systems through spear-phishing emails. The campaign aims to capture passwords, take screenshots, and exfiltrate confidential information from victims.
In plain English
Attackers send deceptive emails containing weaponised ZIP archives. Inside these files, a malicious Windows shortcut masquerades as a document with a spoofed PDF icon. When users open this shortcut, it retrieves an obfuscated HTML Application from attacker-controlled servers. This script uses a legitimate system utility to execute hidden commands on the infected machine.
The background
Trellix researchers documented a multistage infection chain that establishes persistence before loading the remote access Trojan into memory. This approach complicates detection by conventional file scanning methods. The initial script extracts compressed components, including a batch file and decoy documents, to advance the infection without immediate user interaction.
What changes now
The secondary script reconstructs its payload and reflectively loads ReverseRAT into memory using .NET deserialization. This technique reduces exposure to disk-based scanning, although the intrusion still creates detectable artifacts on the system. Operators can execute commands, manipulate files, and initiate shell sessions, granting them extensive access to compromised endpoints.
The attacker's path
Teams usually monitor for unusual script executions spawned by legitimate system utilities like mshta.exe. Check whether endpoints allow HTML Applications to run without explicit user consent. Verify that registry run keys are not being modified by untrusted processes to establish persistence. Look for unexpected network connections to external domains during normal business hours, as these may indicate command-and-control communication.
What to do and how to stay safe: ReverseRAT
- Monitor email gateways for ZIP archives and executable shortcuts disguised as common document types.
- Restrict the execution of HTML Applications and batch scripts on user workstations where possible.
- Review registry run keys for unfamiliar entries that launch scripts or executables upon user login.
- Implement application whitelisting to prevent unauthorised system utilities from launching arbitrary code.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What severity level did Indian authorities assign to this threat?
The October 15, 2026 advisory classifies the threat as medium severity.
What capabilities does the ReverseRAT malware possess?
It can collect system metadata, installed software details, screenshots, passwords, and clipboard contents.
How do attackers establish persistence on the infected system?
Persistence relies on a Windows Registry Run key that launches a batch script when the user signs in.
