SideCopy Expands Spear-Phishing Campaigns to Target Indian Academic Institutions with ReverseRAT

The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. According to Trellix researchers, SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols. The campaigns deliver ReverseRAT malware, granting the threat actor remote access and potential data exfiltration capabilities. This expansion into the academic sector represents a notable shift in SideCopy's targeting profile, with educational institutions now in the crosshairs alongside previous government entity focus. The phishing emails utilize mshta.exe abuse to bypass security controls, allowing execution of malicious scripts that deploy the ReverseRAT payload. While the specific number of targeted institutions and volume of successful compromises remain unverified, the campaign signals an evolution in the threat actor's operational scope and tactics.