In recent months, a Pakistan-linked threat actor known as SideCopy has been making waves in the cybersecurity landscape by targeting Indian government entities. This advanced persistent threat (APT) group has been leveraging the recently discovered WinRAR security vulnerability to launch highly sophisticated phishing campaigns. With the delivery of potent remote access trojans (RATs) such as AllaKore RAT, Ares RAT, and DRat, SideCopy has caused significant concerns within India’s cybersecurity defense circles. This article delves into the intricate details of SideCopy’s activities, exploring their tactics, motivations, and potential implications for Indian security.
Campaign and Trojans
SideCopy’s modus operandi revolves around the deployment of RATs to infiltrate Indian government entities. Various reports indicate that SideCopy is a sub-group of Transparent Tribe, also known as APT36, an actor notorious for its aggressive targeting of India. The group’s recent campaigns have specifically capitalized on the WinRAR security vulnerability, exploiting it to deliver remote access trojans.
SideCopy’s activities did not begin with the recent WinRAR campaign. The group has a history of launching phishing campaigns focused on the Indian defense sector. Their past operations involved sophisticated lures that were tailored to appear as if they were from India’s Defense Research and Development Organization. The aim of these campaigns was to deceive unsuspecting victims into disclosing sensitive information and gaining unauthorized access to their systems.
New Phishing Campaigns
SideCopy has escalated its operations by targeting both Linux and Windows operating systems. In their Linux campaign, they employ a Golang-based ELF binary, enabling them to deploy a Linux version of the Ares RAT. This Linux RAT possesses a range of capabilities, including file enumeration and the ability to capture screenshots, granting the threat actor extensive control over compromised systems.
Windows Campaign
Simultaneously, SideCopy has been exploiting the WinRAR vulnerability (commonly referred to as CVE-2023-38831) to execute malicious code and distribute various RATs, such as AllaKore RAT, Ares RAT, DRat, and Key RAT. Of particular concern is AllaKore RAT, which enables SideCopy to steal system information, perform keylogging activities, capture screenshots, and provide complete remote access to compromised machines. Such capabilities grant the group remarkable control over the targeted systems, allowing them to conduct extensive reconnaissance and potentially carry out further malicious activities.
DRat Functionality
SideCopy’s use of DRat in their campaigns adds another layer of complexity to their attacks. DRat allows the threat actor to remotely issue commands from their command and control (C2) server to gather system data, download and execute additional payloads, and perform various file operations. This functionality significantly enhances SideCopy’s ability to exploit compromised systems and remain undetected within the victim’s network for prolonged periods.
One possible explanation for SideCopy’s targeting of Linux systems is India’s recent decision to replace Microsoft Windows with a Linux-based operating system called Maya OS in government and defense sectors. The intentional focus on Linux platforms serves to exploit any potential vulnerabilities or weaknesses in this transition, establishing SideCopy’s presence and implementing their own agenda within Indian governmental systems.
The emergence of SideCopy, with its close ties to Transparent Tribe (APT36), marks a dangerous new phase in India’s cybersecurity landscape. Through the exploitation of the WinRAR vulnerability and the delivery of potent RATs, this threat actor linked to Pakistan has refined its phishing campaigns to target Indian government entities. As the threat landscape evolves and threat actors become increasingly sophisticated, it is imperative for Indian organizations to prioritize cybersecurity measures, deploy robust defense mechanisms, and maintain constant vigilance in order to protect against persistent threats like SideCopy. Only through comprehensive cybersecurity practices can India safeguard its sensitive government information and maintain the integrity of its critical infrastructure.