SideCopy Group Deploys ReverseRAT via LNK Shortcuts in Indian Spear-Phishing Campaign
Indian authorities warned of a medium-severity campaign on October 15, 2026, where hackers use malicious shortcuts to steal data from organizations and academic institutions.
Key points
- SideCopy actors target Indian entities with spear-phishing emails containing weaponized ZIP archives and deceptive LNK shortcuts.
- The infection chain uses legitimate Windows utilities like mshta.exe to load ReverseRAT into memory, evading standard file scanning.
- Trellix researchers documented the multistage process, which establishes persistence via Registry Run keys before executing the remote access Trojan.
Indian authorities issued an advisory on October 15, 2026, warning that the SideCopy threat group is targeting local organizations and academic institutions with spear-phishing attacks. These campaigns deploy ReverseRAT remote access trojan malware on Windows systems to steal sensitive data, with officials classifying the overall threat as medium severity.
The intrusion begins when recipients open a weaponized ZIP archive attached to a deceptive email. Inside, a malicious Windows shortcut masquerades as a document, using a spoofed PDF icon and misleading file name to trick users into execution. This initial step retrieves an obfuscated HTML Application from attacker-controlled infrastructure at docsportal[.]in, initiating the infection chain.
Technical Execution and Persistence
Trellix researchers documented how the malware exploits legitimate operating system utilities to complicate detection. Windows executes the retrieved script through mshta.exe, allowing attackers to use this system utility as their execution host. The script embeds ne4snapk.dll, which loads into the process via .NET deserialization and acts as a dropper for further components.
This dropper extracts three compressed files: appT.bat, startT.hta, and commskl.docx. While the document serves as a decoy, the scripts advance the infection. Persistence relies on a Windows Registry Run key that launches appT.bat when the affected user signs in, ensuring the malware resumes without requiring another phishing interaction.
The secondary HTA then reconstructs its obfuscated payload and reflectively loads ioluegnt.dll, identified by Trellix as ReverseRAT. This process converts encoded content into an active in-memory payload using .NET deserialization. Although this reduces exposure to disk-based scanning, the broader intrusion still creates scripts and other artifacts on the system.
Capabilities and Impact
ReverseRAT provides operators with extensive access to compromised endpoints. The malware can collect system metadata, details of installed software, screenshots, passwords, and clipboard contents. Operators can also execute commands, manipulate files, upload additional content, and initiate shell sessions, giving them significant control over the infected machine.
The campaign specifically targets Indian organizations, including academic institutions, according to the October 15, 2026, advisory. The threat actors combine deceptive attachments, malicious Windows shortcuts, obfuscated scripts, and legitimate utilities to bypass security controls and establish a foothold within these environments.
What should you do?
Security teams should monitor for unusual mshta.exe activity and unexpected connections to unknown domains. Administrators should review Windows Registry Run keys for suspicious batch scripts or HTA executions. Users should be trained to verify file extensions and icons before opening attachments from unsolicited emails.
What to do and how to stay safe: SideCopy
- Monitor endpoint logs for mshta.exe processes spawning from unexpected parent processes or user directories.
- Inspect Windows Registry Run keys for newly added entries that execute batch files or HTML applications.
- Verify the integrity of downloaded files by checking digital signatures and comparing hashes against known good values.
- Educate users to hover over email attachments to view true file extensions and avoid opening .LNK or .HTA files.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of the SideCopy ReverseRAT campaign?
Indian authorities classified the threat as medium severity in their October 15, 2026, advisory.
How does ReverseRAT evade traditional detection methods?
The malware uses .NET deserialization to load its payload into memory, reducing its footprint on the disk and complicating conventional file scanning.
What specific data can ReverseRAT steal?
The malware can collect system metadata, installed software details, screenshots, passwords, and clipboard contents from compromised endpoints.
