SideCopy

Summary

Named for copying SideWinder's infection chain. Targets Indian defence personnel with HTA-based delivery chains and malicious APK apps impersonating DoD/MoD portals. Deploys AllaKore RAT alongside CrimsonRAT. In mid-2026 activity broadened to Afghan government targets, deploying persistent XenoRAT against the Ministry of Finance via spearphishing and decoy documents.

Attribution

No service publicly attributed

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Pakistani threat group

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 5

Exploited vulnerabilities 1

Highest CVSS first.

Infrastructure patterns

• Compromised domains used for C2 and payload staging (MITRE ATT&CK, 2026)

Reporting and advisories 4

• Seqrite Labs
  Operation XENOFISCAL
• Trellix ARC
  ReverseRAT via mshta — Indian academia
• Recorded Future Insikt
  TAG-140 DRAT V2 — Indian government (ClickFix MoD clone)
• MITRE ATT&CK
  SideCopy (G1008) group profile