TAG-140Threat actor
TAG-140 is a threat actor group that primarily targets Indian government entities, employing cyber espionage tactics such as phishing and malware campaigns. They have deployed a new variant of the DRAT RAT, known as DRAT V2, which utilizes a ClickFix lure and executes a remote script via mshta.exe to establish persistence and facilitate data exfiltration.From MISP Galaxy
Last reported 1 month ago, by The Hacker News1 report
Suspected originPakistanMISP Galaxy
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing“Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.”
Indicators in its reports
named in the reports above- docsportal[.]inin 1 report
- dns.educationportals[.]bizin 1 report
- 45.61.157[.]22in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.