At a glance
Facts
- SideCopy is an advanced persistent threat (APT) group active since at least 2019
SideCopy
Also known as TAG-140
Tracked as
G1008
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.
Threat intelligence assessment
Activity timeline
Facts
- Historically targeted Indian defense forces and government officials
- Recently expanded targeting to academic institutions in India
- In June 2026, attributed to spear-phishing campaign targeting Afghanistan's Ministry of Finance
Attribution assessment
Facts
- SideCopy shares overlaps with the Transparent Tribe cluster
- SideCopy originates from Pakistan
Initial access and identity targets
Facts
- Spear-phishing campaigns delivering weaponized ZIP archives
- Uses Windows shortcuts (LNK) with spoofed PDF icons and .DOCX extensions
Capabilities and evasion
Facts
- ReverseRAT gathers system metadata, installed software lists, screenshots, passwords, and clipboard content
- ReverseRAT performs file operations, command execution, and persistence via Registry
- ReverseRAT uploads files and spawns shell sessions
- Uses multi-stage deobfuscation routines and .NET Deserialization
- Employs anti-forensic self-deletion routines
Infrastructure patterns
Facts
- C2 server: dns.educationportals.biz (resolves to 45.61.157.22)
- Data exfiltration via port 5863
- Remote server: docsportal.in
Communication and pressure channels
Facts
- C2 traffic encrypted using hard-coded cryptographic key: NMXIKS09?:709,!~lnsYUS
Observed targeting
Facts
- Strategic focus includes Indian government entities and academic institutions
- Expanding set of strategic priorities beyond historical targets
Named victims
Organizations
- academic institutions in India
Defender guidance
Facts
- Heavy abuse of mshta.exe and complex multilayered obfuscation require continuous monitoring
- Multi-stage infection chains utilize reflective DLL loading and in-memory payload execution
Reported detail
Facts
- SideCopy is a Pakistan-based APT group active since at least 2019 that has expanded targeting from Indian government to academic institutions
- The group uses spear-phishing with weaponized archives and spoofed documents to deliver ReverseRAT, a RAT with capabilities for data theft, command execution, and persistence
- Attacks employ multi-stage obfuscation, mshta.exe abuse, and in-memory execution to evade disk-based detection
- ReverseRAT communicates with C2 servers using hard-coded encryption and exfiltrates data to dns.educationportals.biz on port 5863
- The threat actor demonstrates disciplined, strategic intelligence collection with continuously refined attack techniques
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
Indicator6 indicators cataloged
Types: domain, ip, tool.
Cataloged
IdentityAlias: TAG-140
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: TAG-140
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G1008
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
SideCopyCanonical Name
TAG-140Alias
G1008Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...