SideCopy Targets Indian Academia With ReverseRAT: Detecting mshta.exe Spear-Social Engineering Attacks

The threat actor tracked as SideCopy — widely assessed to be a Pakistan-aligned APT group with a long operational history against Indian targets — has expanded its targeting from government and defense entities into Indian academic institutions. According to new research from Trellix, the group is running spear-social engineering campaigns that abuse mshta.exe, Microsoft's signed HTML Application host, to execute malicious scripts and ultimately deploy ReverseRAT, a remote access trojan that gives the actor persistent access to victim networks.

This matters for two reasons. First, academia is a softer target than the Indian defense and government sectors SideCopy has historically pursued — university SOC coverage is thinner, endpoint controls are weaker, and faculty mailboxes process a high volume of legitimate attachments from unknown external senders, which is precisely the environment spear-social engineering thrives in. Second, the technique at the center of this campaign — abusing mshta.exe as a living-off-the-land binary (LOLBin) — is a blind spot in far too many environments. If you are not alerting on mshta execution today, you are likely blind to this entire attack class, not just SideCopy.

This post breaks down the campaign's attack chain, what is actually observable on the wire and on the endpoint, and gives you field-tested detection content and hardening steps you can deploy this week.

Campaign Overview and Attack Chain

Who Is SideCopy?

SideCopy has been tracked since at least 2019 and is assessed to operate in support of Pakistani state interests. The group is known for aggressively reusing tooling and infrastructure associated with Transparent Tribe (APT36), including derivatives of open-source and commodity RATs. Historically its victimology centered on Indian defense personnel, government ministries, and critical infrastructure. The pivot to academia observed by Trellix represents a deliberate broadening of collection priorities — universities are rich targets for research data, credentials that pivot into government-adjacent networks, and long-term intelligence access.

The Attack Chain

Based on the reported campaign mechanics, the intrusion sequence looks like this from a defender's vantage point:

1. Delivery via spear-social engineering. Targets receive tailored emails carrying malicious attachments — typically archives containing LNK shortcut files or HTA-laden decoy documents themed around academic or administrative topics. The social engineering is researched and targeted, not spray-and-pray.
2. Execution through mshta.exe. Rather than dropping an unsigned executable, the lure chains into mshta.exe, a signed Microsoft binary, to execute malicious script content — frequently inline VBScript/JScript, or remote HTA content fetched over HTTP/HTTPS. Because mshta is a trusted, signed Windows component, naive application allowlisting and many legacy AV engines let this execute without friction.
3. Script-based staging. The mshta-executed script performs reconnaissance, decodes or downloads the next stage, and establishes persistence — commonly via Run keys or scheduled tasks.
4. ReverseRAT deployment. The final payload, ReverseRAT, is a .NET-based RAT providing remote command execution, file exfiltration, screenshot capture, and payload staging. It typically communicates with actor-controlled C2 over HTTP(S).

The critical defensive insight: the entire initial execution hinge of this campaign is a single LOLBin. Break the mshta leg — or even just alert on it reliably — and you have severed the kill chain at its earliest, cheapest point.

Exploitation Status

This is a confirmed active, in-the-wild campaign against Indian academic institutions as of September 2026. No CVE is associated with this activity — it is pure social engineering plus LOLBin abuse, which is exactly why patching alone cannot stop it. Defensive coverage depends entirely on behavioral detection and execution control.

Affected Organizations and Risk Profile

• Primary targets: Indian universities and academic research institutions
• Historical targeting (still active): Indian government and defense organizations
• Platforms: Windows endpoints (all versions with mshta.exe present — which is effectively all of them)
• Risk to non-Indian organizations: If your institution, NGO, or company collaborates with Indian academic or government entities, expect lure emails to arrive from compromised or spoofed Indian sender infrastructure. Universities worldwide with India-focused research partnerships should treat this as relevant threat intelligence.

Detection & Response

The detections below are tuned against the specific behaviors in this campaign: mshta.exe executing script content, mshta making network connections, and script interpreters spawned from unusual parents. They are designed to be low-noise in environments where mshta has no legitimate business use — which, in 2026, should be nearly every environment.

Sigma Rules

---
title: Suspicious mshta.exe Execution With Script or URL Arguments
id: 3f7c9a12-8e5d-4b61-a934-6c2d5e8f0a1b
status: experimental
description: Detects mshta.exe launched with HTTP(S) URLs, inline script arguments, or VBScript/JScript execution patterns consistent with SideCopy spear-social engineering campaigns abusing mshta to stage ReverseRAT.
references:
  - https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\mshta.exe'
  selection_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'vbscript'
      - 'jscript'
      - 'javascript:'
      - 'about:'
      - '.hta'
      - 'Execute('
      - 'GetObject('
  condition: selection_img and selection_cli
falsepositives:
  - Rare legacy enterprise HTA applications (inventory and migrate or whitelist by full hash/path)
level: high
---
title: mshta.exe Spawning Child Processes
id: 8b2e4d67-1a9c-4f53-b208-7e3a9c1d5f62
status: experimental
description: Detects mshta.exe spawning child processes such as cmd.exe, powershell.exe, or script engines. mshta has no legitimate reason to spawn children in normal operation; this is a strong indicator of HTA-based payload staging as seen in SideCopy operations.
references:
  - https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.execution
  - attack.t1218.005
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\mshta.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; investigate any hit as potentially malicious
level: critical
---
title: Office or Archive-Born Shortcut Launching mshta
id: c5d1f8a3-4e72-4b06-9d18-2f6a7b3e9041
status: experimental
description: Detects mshta.exe spawned by explorer.exe or Office processes shortly after user interaction with LNK files or attachments, matching SideCopy spear-social engineering delivery chains that pivot from shortcuts/documents to mshta execution.
references:
  - https://thehackernews.com/2026/09/sidecopy-broadens-india-targeting-to.html
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/20
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1204.002
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\mshta.exe'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
  filter_rundll_context:
    CommandLine|contains:
      - '\\Program Files\\'
  condition: selection_img and selection_parent and not filter_rundll_context
falsepositives:
  - Legacy line-of-business HTA apps launched by users (rare; document and whitelist explicitly)
level: high

KQL — Microsoft Sentinel / Defender

This query hunts the core campaign behavior: mshta.exe executing with URLs or script arguments, and mshta spawning child processes. It runs against Defender for Endpoint tables (DeviceProcessEvents) and includes a network correlation leg for mshta making outbound connections — something the signed binary has almost no legitimate reason to do.

// SideCopy campaign hunt: mshta.exe abuse for ReverseRAT staging
// Leg 1: mshta executed with URL/script arguments or suspicious parents
let suspiciousMshta = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "mshta.exe"
| where ProcessCommandLine has_any ("http://", "https://", "vbscript", "jscript", "javascript:", ".hta", "GetObject(", "Execute(")
   or InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "explorer.exe")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ProcessId;
// Leg 2: mshta spawning child processes (staging behavior)
let mshtaChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "mshta.exe"
| project ChildTime=TimeGenerated, DeviceName, ChildProcess=FileName,
          ChildCmdLine=ProcessCommandLine, InitiatingProcessCommandLine;
// Leg 3: mshta making network connections (C2 or payload retrieval)
let mshtaNetwork = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "mshta.exe"
| project NetTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine;
suspiciousMshta
| union mshtaChildren
| union mshtaNetwork
| order by TimeGenerated desc

For Sysmon/Sentinel environments without Defender, the equivalent runs against the Event table filtering EventID == 1 and Process endswith "mshta.exe". If you are ingesting proxy or firewall logs into CommonSecurityLog, add a sweep for outbound requests with User-Agent strings containing mshta — a classic artifact of HTA-based remote content retrieval.

Velociraptor VQL

Use this artifact during IR triage or proactive hunts on suspected endpoints. It surfaces mshta processes with suspicious command lines, checks for Run-key persistence (a common ReverseRAT persistence mechanism), and lists active connections from script hosts.

-- SideCopy hunt artifact: mshta abuse + persistence + network indicators
-- Part 1: running mshta / script-host processes with suspicious command lines
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)mshta'
       AND CommandLine =~ '(?i)(http|vbscript|jscript|javascript:|\.hta|GetObject|Execute)')
   OR (Name =~ '(?i)(wscript|cscript|powershell|cmd)'
       AND CommandLine =~ '(?i)(appdata\\|temp\\|programdata\\)')

-- Part 2 (run separately): Run-key persistence commonly used by ReverseRAT
SELECT Name, Data.value AS ValueData, FullPath
FROM read_reg_key(globs='HKLM\Software\Microsoft\Windows\CurrentVersion\Run\*')
WHERE Data.value =~ '(?i)(appdata|temp|programdata)'

-- Part 3 (run separately): active network connections from script hosts
SELECT Pid, Name, Laddr, Raddr, Status
FROM netstat()
WHERE Name =~ '(?i)(mshta|wscript|cscript|rundll32)'
  AND Status =~ 'ESTAB'

Remediation / Hardening Script (PowerShell)

The single most effective control against this campaign is to stop mshta.exe from executing at all unless you have a documented legacy dependency. The script below audits mshta usage (so you can confirm nothing legitimate breaks), deploys a Windows Defender Application Control / AppLocker-style block via the native Attack Surface Reduction rule for Office-to-child-process and script abuse, and enables script blocking and AMSI telemetry. Run elevated on endpoints or deploy via Intune/GPO.

# Security Arsenal - SideCopy mshta abuse hardening
# Requires elevation. Test in audit mode before enforcing in production.

# --- Step 1: Audit recent mshta usage to identify any legitimate dependencies ---
Write-Host "[+] Auditing mshta.exe execution in last 30 days (event log)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'mshta\.exe' } |
  Select-Object TimeCreated, Message -First 50 |
  Format-List

# --- Step 2: Block mshta.exe via Windows Defender Application Control (AppLocker EXE rule) ---
Write-Host "[+] Creating AppLocker deny rule for mshta.exe..." -ForegroundColor Cyan
$mshtaRule = @'
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePublisherRule Id="a1b2c3d4-0001-4000-8000-000000000001" Name="Deny mshta.exe (SideCopy LOLBin mitigation)" Description="Blocks Microsoft HTML Application Host - abused by SideCopy for ReverseRAT staging" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions>
        <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT*WINDOWS*OPERATING SYSTEM" BinaryName="MSHTA.EXE">
          <BinaryVersionRange LowSection="*" HighSection="*" />
        </FilePublisherCondition>
      </Conditions>
    </FilePublisherRule>
  </RuleCollection>
</AppLockerPolicy>
'@
$mshtaRule | Out-File "$env:TEMP\mshta-block.xml" -Encoding UTF8
Set-AppLockerPolicy -XmlPolicy "$env:TEMP\mshta-block.xml" -Merge -ErrorAction SilentlyContinue

# --- Step 3: Enable ASR rule - Block Office apps from creating child processes ---
# 56a863a9-875e-4185-98a7-b882c64b5ce5 = Block abuse of exploited vulnerable signed drivers is NOT it;
# D4F940AB-401B-4EFC-AADC-AD5F3C50688A = Block Office child processes
Write-Host "[+] Enabling ASR rule: Block Office applications from creating child processes..." -ForegroundColor Cyan
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled

# --- Step 4: Enable ASR rule - Block process creation from PSExec/WMI + script obfuscation ---
Write-Host "[+] Enabling ASR rule: Block JavaScript/VBScript from launching downloaded content..." -ForegroundColor Cyan
Add-MpPreference -AttackSurfaceReductionRules_Ids "D3E037E1-3EB8-44C8-A917-57927947596D" -AttackSurfaceReductionRules_Actions Enabled

# --- Step 5: Ensure Defender real-time + cloud protection and PUA blocking are on ---
Write-Host "[+] Verifying Defender real-time, cloud-delivered, and PUA protection..." -ForegroundColor Cyan
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -PUAProtection Enabled

# --- Step 6: Report current mshta block + ASR status ---
Write-Host "[+] Current ASR rule state:" -ForegroundColor Cyan
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Write-Host "[+] Done. Validate mshta is blocked: try 'mshta.exe' from cmd (should be denied)." -ForegroundColor Green

Important: Test the AppLocker deny rule in audit mode first if you run any legacy HTA-based tooling (some older SCCM and line-of-business installers still use HTA). Replace the deny with a hash-allow exception model for those specific binaries.

Remediation and Defensive Recommendations

Because this campaign exploits human trust and a signed Microsoft binary rather than a patchable vulnerability, remediation is architectural, not a patch cycle. Prioritize in this order:

1. Block or tightly constrain mshta.exe. It is a LOLBin with no legitimate role in a modern enterprise. Use AppLocker/WDAC (script above) or your EDR's execution control. This single control breaks the campaign's execution chain.
2. Deploy the Sigma/KQL detections above into your SIEM and validate with a controlled test (e.g., mshta.exe javascript:alert(1) in a lab VM).
3. Enable Microsoft Defender ASR rules, particularly "Block Office applications from creating child processes" (D4F940AB) and "Block JavaScript or VBScript from launching downloaded executable content" (D3E037E1). Both directly counter this lure chain.
4. Strip or detonate attachments at the gateway. SideCopy lures use archives and LNK files. Block .lnk, .hta, and password-protected archives from external senders; sandbox everything else from unverified sources.
5. Disable .hta file association and Windows script host where possible on endpoints that don't need it, and enforce Mark-of-the-Web propagation so downloaded content inherits zone restrictions.
6. Run targeted awareness briefings for academic institutions — faculty and administrative staff are the lure targets here. Emphasize verification of unexpected attachments, especially those themed around administrative, HR, or research-collaboration topics.
7. Hunt for persistence: ReverseRAT commonly establishes Run-key or scheduled-task persistence. Sweep autoruns across the fleet (the VQL artifact above covers the registry leg) and investigate any binaries executing from %AppData%, %ProgramData%, or %Temp%.
8. Network egress filtering: Alert on mshta.exe and script hosts making outbound connections at the proxy/firewall layer, and block uncategorized outbound HTTP(S) from endpoints where feasible.

For organizations with partnerships or user populations connected to Indian academia, treat inbound mail from those domains with elevated scrutiny over the coming weeks — follow-on lures from compromised academic mailboxes are a standard SideCopy tradecraft pattern.

If you suspect compromise, preserve the endpoint, capture autoruns and recent process telemetry, and engage IR immediately — ReverseRAT's file exfiltration and screenshot capabilities mean dwell time directly translates to data loss.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub