SideCopy: The APT36-Aligned Group That Copies SideWinder

SideCopy gets its name from a bit of deliberate misdirection: early on, it copied the tactics, techniques and lure styles of SideWinder — an unrelated, India-nexus actor — apparently to muddy attribution. Behind the disguise it is assessed as Pakistan-nexus, and it operates closely enough with Transparent Tribe (APT36) that researchers have repeatedly found shared or overlapping infrastructure.

Where APT36 is the broad, long-running threat, SideCopy is the specialist that has steadily widened its aim — from Indian government and defence into research and academic institutions.

At a glance

• Suspected origin: Pakistan-nexus; overlaps with Transparent Tribe (APT36)
• Namesake: imitates SideWinder TTPs to complicate attribution
• Primary targets: Indian government, defence, and increasingly research and academia
• Signature malware: ActionRAT, AllaKore RAT, ReverseRAT, AuTo Stealer
• Delivery: spear-phishing with ZIP archives containing LNK files or decoy documents, hosted on compromised domains
• MITRE ATT&CK: G1008 — SideCopy

How they operate

SideCopy's delivery chain is its signature. A spear-phishing email carries a ZIP archive; inside is an LNK file (or a Microsoft Publisher / trojanised document) that kicks off a multi-stage chain, usually pulling the next stage from a compromised website rather than attacker-registered infrastructure. That use of hijacked legitimate domains is part of what makes the group harder to track and block.

The payloads are a rotating family of remote access trojans and stealers:

• ActionRAT — the loader-delivered RAT that gives command execution and the ability to pull further payloads.
• AllaKore RAT — an open-source-derived RAT adapted for the group's needs.
• ReverseRAT and AuTo Stealer — additional access and an info-stealer that hoovers up Office files, PDFs, databases and images, exfiltrating over HTTP or TCP.

The decoy documents are tailored to the victim: defence notices, government circulars, and academic or research material, matching the expansion into universities and research bodies.

The attribution twist

SideCopy is a useful case study in why attribution is hard. By deliberately wearing another group's clothes — mimicking SideWinder — it tried to send analysts down the wrong path. What ultimately tied it to the Pakistan-nexus cluster was infrastructure and tooling overlap with Transparent Tribe, not the surface TTPs it chose to show. For a defender, the lesson is practical: behaviour and infrastructure matter more than the lure's costume.

What defenders should do

• Treat archived LNKs as hostile. The ZIP-then-LNK pattern is the group's front door. Block or quarantine .lnk files in archives, and alert on LNKs that spawn mshta, powershell, or rundll32.
• Watch for staging from compromised sites. Outbound connections from an Office or Explorer process to an unusual website right after a document opens is a strong signal.
• Extend monitoring to research and academic units, which may have lighter defences than government or defence networks but are now squarely in scope.
• Hunt for the known RAT families and their persistence, and feed the current indicators from the India Threat Tracker into your controls.

The takeaway

SideCopy is Transparent Tribe's more specialised, attribution-shy cousin: the same strategic goal, a distinctive ZIP-and-LNK delivery style, and a growing appetite for India's research and academic sector. If you defend any of those, the group belongs on your watchlist.

This article reflects public information as of 18 September 2026, and summarises long-running public reporting on the group.

Sources

• MITRE ATT&CK — G1008 SideCopy
• The Hacker News — SideCopy coverage
• BankInfoSecurity — SideCopy APT targets India's premier defence research agency