SideCopy Shifts to Indian Academia with ReverseRAT via mshta.exe LNK Chain

Trellix documented SideCopy spear-phishing ZIPs containing LNK files with PDF icons that triggered obfuscated HTA scripts. These scripts used reflective DLL loading and self-deletion to drop ReverseRAT, which collected screenshots, credentials, and clipboard data before exfiltrating over encrypted channels. The campaign marks an explicit expansion from prior defense and government focus into universities.

Evidence from Trellix and Seqrite shows consistent infrastructure reuse, including Xeno RAT overlaps in the June 2026 Afghanistan Ministry of Finance operation. The hard-coded key NMXIKS09?:709,!~lnsYUS and dns.educationportals[.]biz domain tie directly to SideCopy's Transparent Tribe-adjacent tooling observed since 2019. No independent packet captures contradict the in-memory .NET deserialization path described.

The pivot to academia likely seeks long-term access to research networks and future officials rather than immediate classified data. This pattern aligns with Transparent Tribe's historical interest in Indian education portals as entry points before lateral movement into government systems.

Education sector defenders should monitor mshta.exe executions and Registry Run keys for startT.hta persistence. Expect SideCopy to refine anti-forensic routines and test new C2 domains within the next quarter.