SideCopy, an APT group targeting India, has been found to overlap with Transparent Tribe. The initial infection occurs through spam emails containing malicious LNK files. Strong email filtering, caution with unknown attachments, and antivirus solutions are recommended to defend against SideCopy.
Table of contents
Key TakeawaysOverviewTechnical DetailsLoader DLLLure DocumentsKaspersky AVPersistenceQuick AVDLL Sideloading (Action RAT)ReverseRatDoMainWork()DoUSBWork()Additional DetailsConclusionOur RecommendationsMITRE ATT&CK® TechniquesIndicators of Compromise (IOCs)Reference2 Impressions