Indian firms face data theft via ReverseRAT malware in SideCopy campaign

Indian organisations, including academic institutions, are currently under attack from the SideCopy threat group. These actors are deploying ReverseRAT, a remote access trojan, through spear-phishing campaigns designed to steal passwords, capture screenshots and collect sensitive information from Windows systems.

Who is targeted and what data is at risk?

The primary targets are Indian organisations and educational bodies. The malware grants operators extensive access to compromised endpoints, allowing them to harvest system metadata, details of installed software and clipboard contents. Operators can also execute commands, manipulate files and initiate shell sessions, giving them broad control over the affected machines.

How does the infection chain operate?

The intrusion begins with a phishing email containing a weaponised ZIP archive. Inside, a malicious LNK shortcut masquerades as a document with a misleading name and a spoofed PDF icon. Opening this shortcut retrieves an obfuscated HTML Application from attacker-controlled infrastructure, which Windows executes through the legitimate mshta.exe utility, complicating detection.

Why is this malware difficult to detect?

Trellix researchers noted that the infection chain establishes persistence before loading the trojan into memory. A dropper DLL extracts compressed components, including a batch script that launches via a Windows Registry Run key upon user sign-in. This allows the malware to resume operations without further phishing interaction, reducing exposure to conventional file scanning.

What does the final payload do?

The secondary script reflectively loads ioluegnt.dll, identified by Trellix as ReverseRAT. This process uses .NET deserialization to convert encoded content into an active in-memory payload. Although the final execution phase minimises disk-based artefacts, the broader intrusion still creates scripts and other indicators, meaning it is a staged infection rather than an entirely fileless attack.

What affected people can do

Teams should verify whether any unexpected shortcut files have been opened recently, particularly those arriving in zip archives or appearing with generic document icons. Users must check for unfamiliar processes running in the background and review startup items for unknown batch scripts. If a system behaves erratically, disconnect it from the network immediately to prevent data exfiltration. Watch for follow-up scams claiming to fix the issue, as attackers often exploit confusion to install further malware or steal credentials.

What to do and how to stay safe: SideCopy

• Monitor email gateways for attachments containing zip archives or executable shortcuts, and block them if policy permits.
• Inspect Windows Registry Run keys for newly added batch scripts or unusual entries that launch hidden processes.
• Review process trees for mshta.exe instances that are not associated with known, authorised applications.
• Ensure endpoint detection tools are configured to alert on reflective loading and .NET deserialization activities.

Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What severity level did authorities assign to this threat?

Indian authorities classified the threat as medium severity in their advisory issued on 15 October 2026.

Which specific malware is being used in this campaign?

The campaign deploys ReverseRAT, a remote access trojan identified by Trellix researchers as ioluegnt.dll.

How does the malware maintain persistence on the system?

It relies on a Windows Registry Run key that launches a batch script when the affected user signs in.