The latest SideCopy campaign targeting academic institutions in India represents an important evolution in the threat actor's targeting strategy.

SideCopy, a Pakistan-linked advanced persistent threat group that has historically concentrated heavily on Indian government, military and defence-related organizations, is now being observed targeting educational and academic institutions through carefully constructed spear-phishing attacks.

What makes this campaign particularly noteworthy is not simply the malware being deployed, but the combination of social engineering, abuse of legitimate Windows components, fileless execution, persistence and encrypted command-and-control communication used to establish long-term access to victim systems.

The ultimate payload is ReverseRAT, a remote access trojan that SideCopy has used in previous campaigns and which provides attackers with extensive surveillance and remote-control capabilities.

The attack begins with a document that is not really a document

The infection begins with a spear-phishing email carrying a weaponized ZIP archive.

Inside is a malicious Windows shortcut file disguised to resemble a legitimate document. The file uses a PDF-style icon and a deceptive filename ending in:

commskll.docx.lnk

This is an important social-engineering technique.

A victim looking casually at the file may interpret it as a DOCX document while the actual executable component is the .LNK shortcut extension.

Once the victim opens the shortcut, the attack chain begins.

This reinforces an important security lesson: file icons and filenames should never be considered reliable indicators of what a file actually is.

SideCopy turns Microsoft's own mshta.exe into part of the attack chain

The malicious shortcut contacts attacker-controlled infrastructure and retrieves an obfuscated HTML Application, or HTA.

The HTA is subsequently executed using:

mshta.exe

This is significant because mshta.exe is a legitimate Microsoft Windows component designed to execute HTML Applications.

Attackers frequently abuse legitimate operating-system utilities because such programs may already be trusted within an environment.

Instead of dropping an obviously malicious executable and launching it directly, the attacker can make Windows perform part of the execution chain on their behalf.

This technique falls into the broader category of living-off-the-land abuse, where legitimate tools already present on a system are repurposed for malicious activity.

Security teams should therefore avoid detection strategies based solely on identifying known malicious executable files.

The behaviour of trusted processes can be just as important as the reputation of the process itself.

The malware deliberately reduces its footprint on disk

Once the initial HTA executes, the attack progresses through several additional stages.

The first HTA contains an embedded DLL that is loaded into the mshta.exe process.

The malware subsequently removes the downloaded HTA file after the next infection stage has been initialized.

This self-deletion behaviour helps reduce forensic artefacts and makes retrospective investigation more difficult.

The dropper then installs several components, including:

  • a batch-file persistence loader;
  • another malicious HTA stage; and
  • a legitimate-looking decoy document.

Displaying a decoy document is an important part of the deception.

From the victim's perspective, opening the attachment may appear to have worked normally. Meanwhile, the malicious infection process continues in the background.

Registry persistence allows the malware to return after reboot

SideCopy establishes persistence by modifying the Windows Registry Run key.

The malicious batch file is configured to execute automatically when the user logs in and launches the next HTA stage through mshta.exe.

This means the malware does not depend solely on its initial execution.

Once persistence is established, restarting the computer does not necessarily remove the attacker.

Monitoring changes to locations such as:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

therefore remains highly valuable, particularly when the configured command launches interpreters, scripting engines or utilities such as mshta.exe.

The final payload is reconstructed and executed directly in memory

One of the technically interesting parts of the campaign is how the final malware payload is activated.

According to Trellix's analysis, the second-stage HTA contains heavily obfuscated code that reconstructs the payload through multiple decoding stages.

The malware uses .NET functionality, including BinaryFormatter deserialization and reflection, to reconstruct and load the malicious DLL directly into memory.

Ultimately, the ReverseRAT payload is reflectively loaded inside mshta.exe.

This approach helps the attacker avoid writing the final malicious executable to disk in the conventional manner.

That matters because traditional antivirus approaches historically relied heavily on scanning files before they were executed.

Modern attacks increasingly force defenders to look for behaviour such as:

  • unusual memory allocation;
  • reflective assembly loading;
  • suspicious child processes;
  • script interpreters making network connections;
  • deserialization activity;
  • persistence modifications; and
  • legitimate Windows utilities behaving in ways inconsistent with normal business use.

This campaign is another demonstration of why behavioural detection is increasingly important alongside signature-based protection.

ReverseRAT gives attackers extensive control over the victim

Once installed, ReverseRAT provides SideCopy with a substantial set of espionage capabilities.

The malware can gather system information and installed software, capture screenshots, steal passwords, read clipboard contents and inspect files and directories.

It can also:

  • execute commands;
  • start a remote shell;
  • upload and download files;
  • manipulate files and folders;
  • collect host information;
  • establish additional persistence;
  • capture information displayed on the victim's screen; and
  • remotely interact with the compromised machine.

For an academic institution, these capabilities could expose far more than an individual workstation.

A compromised system may contain access to research documents, institutional correspondence, staff information, collaboration portals, credentials and potentially sensitive government or defence-related research.

The attacker may therefore be interested not merely in the university itself, but in the relationships, research and people connected to it.

Why would academic institutions be valuable intelligence targets?

The expansion into academia should not be dismissed as an attack against a softer target merely because universities do not look like conventional military infrastructure.

Academic institutions can hold substantial strategic intelligence.

Indian universities and research organizations may work with:

  • defence establishments;
  • government ministries;
  • critical infrastructure organizations;
  • aerospace and space programmes;
  • strategic technologies;
  • engineering research;
  • cybersecurity projects;
  • energy programmes;
  • international research partners; and
  • current or former government personnel.

They also contain large numbers of students, academics and researchers who communicate extensively with external organizations.

Compromising such environments could potentially provide intelligence on research programmes, individuals, relationships and future projects.

Academic environments can additionally be attractive because they often combine valuable information with large and diverse user populations, extensive collaboration and comparatively open network requirements.

That combination creates a difficult defensive environment.

Academia can also become a pathway to higher-value targets

There is another reason this change in targeting deserves attention.

An academic institution does not necessarily have to contain the attacker's ultimate objective.

Researchers frequently collaborate with government agencies, defence organizations and private technology companies.

Compromised email accounts or systems could potentially be used to understand those relationships or construct more credible attacks against connected organizations.

A genuine academic identity communicating with another institution is considerably more convincing than a completely unknown sender.

This makes universities and research organizations potentially useful both as intelligence targets and stepping stones for subsequent social-engineering operations.

Command-and-control traffic provides useful network-level detection opportunities

Trellix identified the campaign communicating with:

dns[.]educationportals[.]biz

resolving to:

45[.]61[.]157[.]22

The ReverseRAT command-and-control channel uses TCP port:

5863

and encrypts communications using a hard-coded cryptographic key.

These indicators provide defenders with immediate hunting opportunities.

However, organizations should not rely exclusively on the published domain, IP address or malware hashes.

Infrastructure can be replaced quickly.

Behavioural indicators are considerably harder for an attacker to eliminate without changing the attack itself.

Security monitoring should therefore look for combinations such as:

LNK execution → mshta.exe → external network connection → HTA execution → Registry persistence → suspicious in-memory .NET activity → uncommon outbound TCP connection.

That behavioural sequence is much more useful than treating each indicator independently.

Organizations should pay particular attention to mshta.exe

mshta.exe appears repeatedly throughout this attack chain and therefore represents a valuable detection point.

Organizations where HTA applications have no legitimate business requirement should consider restricting or disabling their execution using application-control policies such as AppLocker or Windows Defender Application Control.

Where outright blocking is not possible, security teams should consider alerting on behaviours including:

  • mshta.exe retrieving content from the Internet;
  • mshta.exe executing files from temporary or public directories;
  • mshta.exe loading unusual .NET assemblies;
  • mshta.exe launching scripts or command interpreters;
  • mshta.exe creating or modifying Registry Run keys; and
  • mshta.exe establishing outbound connections to previously unseen destinations.

The important distinction is context.

Seeing mshta.exe on a Windows computer is not automatically evidence of compromise.

Seeing mshta.exe launched by a suspicious shortcut, downloading remote content and subsequently establishing persistence is quite another matter.

Email security remains the first opportunity to stop the attack

Despite the sophistication of later infection stages, this campaign still depends heavily on convincing a human being to open the initial spear-phishing attachment.

Organizations can therefore disrupt the attack before ReverseRAT ever reaches memory.

Email security controls should scrutinize or quarantine high-risk attachment formats including:

  • .LNK
  • .HTA
  • .ISO

and archives containing them.

Organizations should also consider whether ordinary users have any legitimate reason to receive Windows shortcut files through external email.

In many environments the answer will be approximately none, which makes blocking them considerably easier than humans sometimes make security policy.

Network egress controls are equally important

The campaign also demonstrates why organizations should control outbound network traffic rather than assuming all internally initiated connections are legitimate.

Endpoints should not necessarily be permitted to establish arbitrary outbound connections to any destination and port.

Monitoring uncommon destination ports and newly observed domains can provide another opportunity to detect an infection that has bypassed endpoint controls.

DNS monitoring is particularly valuable because malware frequently needs to resolve its command-and-control infrastructure before communication begins.

Even when encrypted traffic prevents defenders from seeing the contents of a session, metadata such as:

  • destination domain;
  • destination IP;
  • destination port;
  • connection frequency;
  • process responsible for the connection; and
  • historical reputation

can reveal significant information.

The bigger concern is SideCopy's continued evolution

SideCopy has been tracked since at least 2019 and has repeatedly targeted South Asian organizations, particularly Indian government and defence interests.

Earlier research has documented the group's use of multiple RAT families, exploitation techniques and Windows and Linux attack chains.

The latest campaign demonstrates that its toolset continues to evolve while its victim profile is broadening.

That is arguably more important than any single malware sample.

Threat actors involved in long-running espionage operations rarely depend on one domain, one executable hash or one infection technique indefinitely.

Defenders therefore need to understand the behaviour and objectives of the adversary, not merely maintain a collection of indicators from yesterday's campaign.

What Indian organizations should take from this campaign

For Indian academic, research, defence and government organizations, the SideCopy campaign reinforces several priorities:

Strengthen spear-phishing defenses.
Attachments that masquerade as legitimate documents remain an effective initial-access technique.

Control living-off-the-land tools.
Utilities such as mshta.exe should be restricted when they are not operationally necessary.

Monitor behaviour, not just malware files.
Fileless and in-memory execution can significantly reduce traditional disk artefacts.

Monitor outbound communications.
C2 traffic may reveal an attack that endpoint controls failed to prevent.

Hunt for persistence.
Registry Run keys and other autorun mechanisms should be continuously monitored.

Protect academic environments as strategic infrastructure.
Universities and research institutions can possess information and relationships with significant intelligence value.

Share threat intelligence across sectors.
When adversaries move between defence, government and academia, defensive intelligence needs to move just as quickly.

The broader cybersecurity lesson

Perhaps the most important aspect of this campaign is SideCopy's shift in victim selection.

Cyber-espionage does not stop at the gates of government ministries or military establishments.

Attackers follow information.

When valuable information, strategic research or relationships with sensitive organizations exist within universities, universities themselves become intelligence targets.

The SideCopy campaign also demonstrates how modern espionage increasingly combines relatively simple social engineering with technically sophisticated post-exploitation.

The victim sees what appears to be a document.

Behind that single click is a chain involving a malicious shortcut, remote HTA retrieval, abuse of a legitimate Windows binary, anti-forensic file deletion, Registry persistence, .NET deserialization, reflective loading, encrypted command-and-control and a fully functional remote access trojan.

The expanding focus on Indian academia should therefore be viewed not simply as another phishing campaign, but as evidence that the cyber-espionage perimeter around strategically important Indian organizations is becoming wider.

Defence against such campaigns requires protecting not only obvious government and military targets, but also the universities, researchers, suppliers and institutions connected to them.

The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities. "SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers

Source: SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing via The Hacker News — published 22 Sep 2026.