# SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain

> SideCopy (TAG-140, Pakistan-linked, overlapping with the Transparent Tribe cluster) is spear-phishing Indian academic institutions and other organizations with ZIP archives containing LNK shortcuts disguised as documents. The chain runs an obfuscated HTA through mshta.exe, loads ne4snapk.dll via .NET deserialization, and reflectively loads ReverseRAT (ioluegnt.dll) in memory for data theft, screenshots, password theft and remote command execution.

- **Published:** 2026-10-17T13:25:49Z
- **Last reviewed:** 2026-10-17T13:25:49Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3806
- **ID:** TL-2026-3806
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** SideCopy (Pakistan)
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trellix ARC and press reporting (The Hacker News, SC Media, GBHackers) describe a SideCopy campaign against Indian academic institutions and other Indian organizations. An Indian-authority advisory dated 2026-10-15 rated the activity medium severity.

Initial access is a spear-phishing email carrying a weaponized ZIP archive. The archive holds a Windows shortcut (reported as commskll.docx.lnk) with a spoofed PDF icon and a .docx-style name. The LNK retrieves an obfuscated HTA from attacker infrastructure (docsportal[.]in) and runs it with mshta.exe. The HTA embeds ne4snapk.dll, which is loaded into mshta.exe through a .NET deserialization technique.

ne4snapk.dll acts as a dropper for three components: appT.bat (persistence loader), startT.hta (second-stage HTA) and commskl.docx (decoy document shown to the victim). Persistence is a Windows Registry Run key that launches appT.bat at user sign-in. The batch script starts mshta.exe to run startT.hta in the background. startT.hta uses multi-stage deobfuscation, with Base64 encoding, to rebuild a two-part XAML payload in memory. It then reflectively loads ioluegnt.dll, which is ReverseRAT. The reporting also notes anti-forensic self-deletion.

ReverseRAT has been used by SideCopy since early 2021. It collects system metadata, the installed software list, screenshots, passwords and clipboard contents. It also performs file operations, uploads files, runs commands and spawns a shell session. C2 traffic goes to dns[.]educationportals[.]biz (reported as resolving to 45.61.157.22) over TCP 5863. The traffic is encrypted with a hard-coded key reported as NMXIKS09?:709,!~lnsYUS. The reported commonalities with other SideCopy activity are: a June 2026 campaign against Afghanistan's Ministry of Finance using Xeno RAT, and historical targeting of Indian defense and government personnel. The India academia focus is described as a strategic expansion.

No CVEs are involved, and no file hashes were published in the available sources. Defenders should hunt on LNK-to-mshta.exe process chains, mshta.exe network connections, new Run key entries that point to appT.bat, and outbound connections on TCP 5863. Some primary sources (Trellix blog, SC Media, The Hacker News) returned HTTP 403 to direct fetch, so details come from search-result excerpts and the GBHackers and Hacker News page extractions.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1218.005 Mshta
- T1059.005 Visual Basic
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1620 Reflective Code Loading
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1082 System Information Discovery
- T1518 Software Discovery
- T1113 Screen Capture
- T1555 Credentials from Password Stores
- T1140 Deobfuscate/Decode Files or Information
- T1036.007 Double File Extension
- T1005 Data from Local System
- T1573.001 Symmetric Cryptography
- T1571 Non-Standard Port

## Sources

- [SideCopy Hackers Target Indian Organizations With ReverseRAT Malware to Steal Data](https://gbhackers.com/sidecopy-hackers-target-indian-organizations/)
- [Trellix: SideCopy threat intel - mshta execution and RAT deployment](https://www.trellix.com/blogs/research/sidecopy-threat-intel-mshta-execution-rat-deployment/)
- [The Hacker News: SideCopy broadens India targeting](https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html)
- [SC World: SideCopy threat actor targets Indian academic institutions with new attack methods](https://www.scworld.com/brief/sidecopy-threat-actor-targets-indian-academic-institutions-with-new-attack-methods)
- [Cisco Talos: SideCopy](https://blog.talosintelligence.com/sidecopy/)
- [Cyble: SideCopy threat actor profile](https://cyble.com/threat-actor-profiles/sidecopy/)
- [SecurityOnline: SideCopy APT campaign](https://securityonline.info/sidecopy-apt-campaign/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3806