SideCopyThreat actor
The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor.From MISP Galaxy
Last reported 1 month ago, by The Hacker News1 report
Suspected originPakistanMISP Galaxy
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing“SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing”
Indicators in its reports
named in the reports above- docsportal[.]inin 1 report
- dns.educationportals[.]bizin 1 report
- 45.61.157[.]22in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.