How SideCopy Actors Use Windows Shortcuts to Deploy ReverseRAT in India
Indian officials report a medium-severity campaign targeting firms with phishing emails that disguise malware as PDFs, leading to data theft via remote access tools.
Key points
- SideCopy hackers target Indian organizations and universities using spear-phishing emails with malicious ZIP archives.
- The attack chain uses fake LNK shortcuts and system utilities to load ReverseRAT into memory, evading disk scans.
- Trellix researchers found the malware steals passwords, screenshots, and system data while maintaining registry persistence.
Indian authorities issued an advisory on October 15, 2026, warning that the SideCopy threat group is targeting domestic organizations and academic institutions. According to GBHackers, these attackers deploy the ReverseRAT remote access Trojan through spear-phishing campaigns. The advisory classifies the threat as medium severity, noting that the malware can harvest passwords, capture screen content, and exfiltrate sensitive information from Windows systems.
How does the infection chain begin?
The intrusion starts with a phishing email containing a weaponized ZIP archive. Inside, attackers place a malicious Windows shortcut file (LNK) that mimics a document. This shortcut uses a spoofed PDF icon and a misleading filename to trick recipients into executing it. Once opened, the shortcut retrieves an obfuscated HTML Application (HTA) from the attacker-controlled domain docsportal[.]in, initiating the next stage of the attack.
What roles do system utilities play?
Windows executes the downloaded HTA script using the legitimate utility mshta.exe. This allows attackers to leverage a trusted system process as their execution host. The HTA contains a DLL named ne4snapk.dll, which loads into the mshta.exe process via .NET deserialization. This dropper component extracts three compressed files: appT.bat, startT.hta, and a decoy document, advancing the infection without immediately dropping the final payload.
How does the malware persist and hide?
Persistence is achieved through a Windows Registry Run key that launches appT.bat when the user signs in. This batch script silently starts mshta.exe to run startT.hta in the background. The secondary HTA reconstructs its payload and reflectively loads ioluegnt.dll, identified by Trellix as ReverseRAT. This in-memory loading technique complicates detection by conventional file scanning, though the campaign still leaves script artifacts on the disk.
What capabilities does ReverseRAT offer?
ReverseRAT grants operators extensive control over compromised endpoints. According to Trellix, the tool can collect system metadata, details of installed software, screenshots, passwords, and clipboard contents. Operators can also execute arbitrary commands, manipulate files, upload additional content, and initiate shell sessions. This broad functionality allows attackers to maintain access and gather intelligence from targeted Windows environments.
What analysts watch for
Teams usually monitor for unexpected executions of mshta.exe, particularly when launched from user profile directories or via batch scripts. Analysts should check registry Run keys for newly added entries that point to batch files or temporary scripts. Since this campaign uses LNK files to initiate the chain, endpoint detection rules should flag shortcuts that launch HTA or PowerShell scripts. Investigating network traffic for connections to known malicious domains, such as docsportal[.]in, helps identify compromised hosts early.
What to do and how to stay safe: SideCopy
- Review email attachments for suspicious ZIP archives and avoid opening LNK files from untrusted sources.
- Monitor system logs for mshta.exe processes that are not associated with known business applications.
- Check Windows Registry Run keys for unfamiliar entries that execute batch scripts or HTML applications.
- Ensure endpoint protection is configured to detect reflectively loaded DLLs and in-memory payloads.
Step-by-step guide: Build an Incident Response Plan That Actually Works
General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which organizations are targeted by the SideCopy group?
Indian authorities report that the group targets Indian organizations, including academic institutions, using spear-phishing attacks.
How does ReverseRAT evade traditional detection?
The malware uses .NET deserialization to load its payload into memory, reducing its footprint on disk and complicating file-based scanning.
What specific data can ReverseRAT steal?
The remote access tool can collect passwords, screenshots, clipboard contents, system metadata, and details of installed software.
