Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · SideCopy · Unknown · assessed origin Pakistan · misp-galaxy + mitre-attack · refreshed 2026-10-06 · on the wire

SideCopy

MITRE G1008 ↗

SideCopy — ATT&CK roseSI

attack rose · 16 techniques across 7 tactics

Last 30 days

last seen 25 d ago
dispatch1
victims0
CVEs seen0

What changed

ledger · newest first
  1. —24 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor. Cisco Talos and Seqrite have provided comprehensive reports on this actor’s activities.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

16 techniques · 7 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    2 techniques

  3. Initial access

    1 technique

  4. Execution

    3 techniques

  5. Stealth

    3 techniques

  6. Discovery

    5 techniques

  7. Command and control

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
AuTo StealerS1029 ↗
Action RATS1028 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

On the wire

1 dispatch · newest first
  1. SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing

Take it with you

keyless · no signup

References

8 sources
  1. 1.seqrite.com/blog/operation-sidecopy
  2. 2.blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lu…
  3. 3.telsy.com/sidecopy-apt-from-windows-to-nix
  4. 4.blog.talosintelligence.com/2021/07/sidecopy.html
  5. 5.about.fb.com/news/2021/11/taking-action-against-hackers-in-pakistan…
  6. 6.sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d
  7. 7.attack.mitre.org/groups/G1008
  8. 8.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-vic…

Track SideCopy on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.