SYMBOLCOMMON_NAMEaka. SYNONYMS

SideCopy  (Back to overview)


The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor. Cisco Talos and Seqrite have provided comprehensive reports on this actor’s activities.

Associated Families
elf.unidentified_005 win.action_rat win.curlback
References
2025-04-08 ⋅ Seqrite ⋅ Sathwik Ram Prakki
Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks
CurlBack RAT XenoRAT
2024-07-25 ⋅ Seqrite ⋅ Sathwik Ram Prakki
Umbrella of Pakistani Threats: Converging Tactics of Cyber-operations Targeting India
DISGOMOJI Poseidon Action RAT AllaKore ReverseRAT
2023-11-06 ⋅ Seqrite ⋅ Sathwik Ram Prakki
SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT
Action RAT AllaKore
2023-06-15 ⋅ Seqrite ⋅ Sathwik Ram Prakki
Double Action, Triple Infection, and a New RAT: SideCopy’s Persistent Targeting of Indian Defence
Action RAT
2023-02-16 ⋅ ThreatMon ⋅ Seyit Sigirci (@h3xecute), ThreatMon Malware Research Team
APT SideCopy Targeting Indian Government Entities - Analysis of the new version of ReverseRAT
Unidentified 005 (Sidecopy) ReverseRAT
2023-01-01 ⋅ ThreatMon ⋅ Seyit Sigirci (@h3xecute), ThreatMon Malware Research Team
Unraveling the Complex Infection Chain: Analysis of the SideCopy APT's Attack
Action RAT
2022-01-18 ⋅ ⋅ Qianxin ⋅ Red Raindrop Team
SideCopy Arsenal Update: Golang-based Linux stealth tools surface
Unidentified 005 (Sidecopy)
2022-01-05 ⋅ Telsy ⋅ Claudio Di Giuseppe
SIDECOPY APT: From Windows to *nix
SideCopy
2021-12-02 ⋅ Malwarebytes ⋅ Hossein Jazi, Threat Intelligence Team
SideCopy APT: Connecting lures to victims, payloads to infrastructure
SideCopy
2021-11-16 ⋅ META ⋅ David Agranovich, Mike Dvilyanski
Taking Action Against Hackers in Pakistan and Syria
SideCopy
2021-07-07 ⋅ Talos Intelligence ⋅ Asheer Malhotra, Justin Thattil
InSideCopy: How this APT continues to evolve its arsenal
AllaKore NjRAT SideCopy
2020-09-23 ⋅ Seqrite ⋅ Kalpesh Mantri
Operation SideCopy!
SideCopy
2019-07-08 ⋅ Medium Sebdraven ⋅ Sébastien Larinier
Copy cat of APT Sidewinder ?
AllaKore SideCopy
Credits: MISP Project