SideCopy

SideCopy is a Pakistani threat actor, or Advanced Persistent Threat (APT), that has been active since at least 2019, predominantly targeting South Asian countries, specifically India and Afghanistan. Its modus operandi includes the use of archive files embedded with Lnk, Microsoft Publisher, or Trojanized Applications as lures. The group's infection chain involves multiple steps, each carefully designed to ensure successful compromise. In addition to this, it has been observed that SideCopy shares tactical overlaps with other groups such as Transparent Tribe, indicating a possible subordinate relationship. In recent operations, SideCopy has demonstrated its capability to exploit security vulnerabilities to further its objectives. Notably, in November 2023, it leveraged a WinRAR vulnerability to target Indian government entities, deploying various remote access trojans like AllaKore RAT, Ares RAT, and DRat. This attack was part of two new campaigns against Indian government organizations' Windows and Linux systems. Furthermore, the group has been seen expanding its Linux arsenal, sharing Linux stagers with APT36 to deploy an open-source Python RAT called Ares. The impact of SideCopy's activities is significant, with the group successfully stealing several Office documents and databases associated with the Government of Afghanistan. Macro-based Office documents continue to be a common vector for initiating attacks and distributing payloads among APT groups, including SideCopy. As the group continues to evolve and expand its capabilities, particularly through the use of zero-day vulnerabilities, it poses an ongoing threat to defense organizations in India and other targeted regions.