Threat reportMalwareTL-2026-3806
SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain
SideCopy Targets Indian Organizations with ReverseRAT via (TL-2026-3806) is a medium-severity malware campaign, first published 2026-10-17. It is attributed to SideCopy (Pakistan) with medium confidence, affects Microsoft Windows (endpoints running mshta.exe), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1036.007), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1SideCopy
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-3806
- Threat ID
- TL-2026-3806
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- SideCopy
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- education, government administration, defense
- Target regions
- india, South Asia
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in SideCopy Targets Indian Organizations with ReverseRAT via
Malware and tooling: RemCom, ReverseRAT, XenoRAT
How SideCopy Targets Indian Organizations with ReverseRAT via works
SideCopy (TAG-140, Pakistan-linked, overlapping with the Transparent Tribe cluster) is spear-phishing Indian academic institutions and other organizations with ZIP archives containing LNK shortcuts disguised as documents. The chain runs an obfuscated HTA through mshta.exe, loads ne4snapk.dll via .NET deserialization, and reflectively loads ReverseRAT (ioluegnt.dll) in memory for data theft, screenshots, password theft and remote command execution.
Trellix ARC and press reporting (The Hacker News, SC Media, GBHackers) describe a SideCopy campaign against Indian academic institutions and other Indian organizations. An Indian-authority advisory dated 2026-10-15 rated the activity medium severity.
Initial access is a spear-phishing email carrying a weaponized ZIP archive. The archive holds a Windows shortcut (reported as commskll.docx.lnk) with a spoofed PDF icon and a .docx-style name. The LNK retrieves an obfuscated HTA from attacker infrastructure (docsportal[.]in) and runs it with mshta.exe. The HTA embeds ne4snapk.dll, which is loaded into mshta.exe through a .NET deserialization technique.
ne4snapk.dll acts as a dropper for three components: appT.bat (persistence loader), startT.hta (second-stage HTA) and commskl.docx (decoy document shown to the victim). Persistence is a Windows Registry Run key that launches appT.bat at user sign-in. The batch script starts mshta.exe to run startT.hta in the background. startT.hta uses multi-stage deobfuscation, with Base64 encoding, to rebuild a two-part XAML payload in memory. It then reflectively loads ioluegnt.dll, which is ReverseRAT. The reporting also notes anti-forensic self-deletion.
ReverseRAT has been used by SideCopy since early 2021. It collects system metadata, the installed software list, screenshots, passwords and clipboard contents. It also performs file operations, uploads files, runs commands and spawns a shell session. C2 traffic goes to dns[.]educationportals[.]biz (reported as resolving to 45.61.157.22) over TCP 5863. The traffic is encrypted with a hard-coded key reported as NMXIKS09?:709,!~lnsYUS. The reported commonalities with other SideCopy activity are: a June 2026 campaign against Afghanistan's Ministry of Finance using Xeno RAT, and historical targeting of Indian defense and government personnel. The India academia focus is described as a strategic expansion.
No CVEs are involved, and no file hashes were published in the available sources. Defenders should hunt on LNK-to-mshta.exe process chains, mshta.exe network connections, new Run key entries that point to appT.bat, and outbound connections on TCP 5863. Some primary sources (Trellix blog, SC Media, The Hacker News) returned HTTP 403 to direct fetch, so details come from search-result excerpts and the GBHackers and Hacker News page extractions.
MITRE ATT&CK techniques used in TL-2026-3806
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1036.007 Double File Extension; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1620 Reflective Code Loading
Execution
T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1204.002 Malicious File
Discovery
T1082 System Information Discovery; T1518 Software Discovery
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
T1555 Credentials from Password Stores
Initial Access
T1566.001 Spearphishing Attachment
Command and Control
Affected products and versions in SideCopy Targets Indian Organizations with ReverseRAT via
- Microsoft — Windows (endpoints running mshta.exe)
Vulnerable versions: Windows endpoints permitting LNK/HTA execution
Remediation for SideCopy Targets Indian Organizations with ReverseRAT via
Immediate actions
- Block docsportal.in and dns.educationportals.biz (45.61.157.22) at DNS and perimeter; alert on outbound TCP 5863
- Hunt for LNK files inside ZIP archives spawning mshta.exe, and for appT.bat, startT.hta, ne4snapk.dll and ioluegnt.dll on endpoints
- Quarantine suspicious ZIP/LNK attachments at the mail gateway
Workarounds
- Block LNK and HTA file delivery via email and web gateways
- Disable the Windows Script Host and HTA association for standard users where feasible
Longer-term hardening
- Restrict or block mshta.exe where it is not required (application control / ASR rules)
- Deploy EDR with behavioral detection for reflective .NET loading and script-host abuse
- Run phishing-awareness training for academic and government staff on LNK/ZIP attachments
Timeline of SideCopy Targets Indian Organizations with ReverseRAT via
- SideCopy (TAG-140) active since at least 2019 per The Hacker News (year-level precision), historically targeting Indian defense forces and government officials.
- ReverseRAT in use by SideCopy since early 2021 (sources give no exact day; date is the start of the year).
- SideCopy campaign against Afghanistan's Ministry of Finance using Xeno RAT reported for June 2026 (month-level precision).
- The Hacker News (citing Trellix research) reports SideCopy's LNK/mshta/ReverseRAT campaign against Indian academic institutions, an expansion beyond its historical government and defense focus.
- Indian authority advisory on the SideCopy ReverseRAT campaign issued, rated medium severity.
- GBHackers publishes coverage of the SideCopy ReverseRAT campaign against Indian organizations.
Sources cited for SideCopy Targets Indian Organizations with ReverseRAT via
- SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data
- Trellix: SideCopy threat intel - mshta execution and RAT deployment
- The Hacker News: SideCopy broadens India targeting
- SC World: SideCopy threat actor targets Indian academic institutions with new attack methods
- Cisco Talos: SideCopy
- Cyble: SideCopy threat actor profile
- SecurityOnline: SideCopy APT campaign
Detection coverage for TL-2026-3806
As of 2026-10-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3806 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.