SideCopy

SideCopy is a Pakistani threat actor that has been operational since at least 2019, primarily targeting South Asian countries, specifically India and Afghanistan. The Advanced Persistent Threat (APT) group uses lures such as archive files embedded with Lnk, Microsoft Publisher or Trojanized Applications to initiate attacks. The group's infection chain involves multiple steps, each meticulously executed to ensure successful compromise. SideCopy has also been identified as a suspected subordinate element within Transparent Tribe, another Pakistan-linked APT group. Tactical overlaps have been found between SideCopy and Transparent Tribe, further strengthening the connection. In recent operations, SideCopy has exploited a WinRAR vulnerability to target Indian government entities, aiming to deliver various remote access trojans (RATs) such as AllaKore RAT, Ares RAT, and DRat. The group has also used a new Stealer and a Loader to drop and load an executable (credbiz.exe) which side-loads the Stealer. This strategy was notably effective in stealing several Office documents and databases associated with the Government of Afghanistan. Additionally, APT36, another threat actor, has been observed sharing its Linux stagers with SideCopy to deploy an open-source Python RAT called Ares. SideCopy's consistent targeting of Indian defense organizations using various RATs, including the exploitation of zero-day vulnerabilities, underscores its persistent threat. All compromised domains used by SideCopy this year were registered with GoDaddy and hosted on HostGator servers. Despite efforts from cybersecurity industry, groups like SideCopy, Kimsuky, Donot, and Emotet continue to rely on macro-based Office documents to launch attacks and distribute their payloads, demonstrating the ongoing challenge posed by these sophisticated threat actors.