India-focused threat actor SideCopy has expanded its targeting to academic institutions, using weaponized Windows shortcut files and Microsoft’s legitimate HTML Application utility to deliver a remote access trojan through a largely fileless attack chain, according to Trellix researchers.
The Pakistan-based group has historically targeted Indian government entities and high-ranking personnel for surveillance and intelligence gathering. Trellix said the recent shift toward academic institutions signals an expansion of SideCopy’s strategic priorities, though the researchers stopped short of specifying what information the group is after in these attacks.
How the Attack Unfolds
The campaign begins with a spear-phishing email carrying a ZIP archive. Inside, attackers plant a malicious Windows shortcut (LNK) file disguised with a PDF icon and a filename designed to resemble a legitimate DOCX document, alongside a decoy GIF.
When a victim opens the LNK file, it retrieves an obfuscated HTML Application (HTA) file from attacker-controlled infrastructure and runs it using mshta.exe, a legitimate Windows utility built to execute HTA files.
According to Trellix, this initial HTA file contains an embedded DLL and uses .NET deserialization to trigger the next stage of the attack. The malware then deletes the HTA file from disk, minimizing forensic evidence.
Persistence is established through a Windows Registry Run Key, which launches a batch file that executes a second-stage HTA via mshta.exe on every system startup.
Why mshta.exe Is Central to the Campaign
Rather than relying on a conventional executable, SideCopy abuses a trusted Windows component to run malicious code and move between infection stages — a classic “living off the land” technique that helps it blend in with legitimate system activity.
The malware also uses .NET’s BinaryFormatter functionality to reconstruct encoded objects in memory, letting it decompress and load additional components without keeping the full payload as a file on disk.
The final payload identified by researchers as ioluegnt.dll — is reflectively loaded directly into the memory of the mshta.exe process, where .NET reflection is used to instantiate and execute it.
What the RAT Can Do
Once active, the RAT can:
- Gather system information and enumerate installed software
- Capture screenshots and collect clipboard data
- Steal passwords
- Manipulate files and execute commands
- Provide attackers with shell access
The malware communicates with its command-and-control infrastructure over an encrypted connection. Trellix identified dns[.]educationportals[.]biz as one associated domain, which resolved to an active IP address at the time of analysis.
Why It Matters to CISOs
This campaign is a clear reminder of how legitimate Windows tools can undermine traditional defenses. SideCopy’s use of mshta.exe, weaponized LNK and HTA files, and in-memory execution all work to reduce the file-based detection opportunities most security tools rely on.
It also underscores why security teams need to correlate process execution, registry changes and network activity rather than depend solely on malware signatures. Unusual mshta.exe executions and unexpected Registry Run Key modifications are valuable detection points worth watching closely.
Recommended actions for CISOs:
- Assess whether mshta.exe is genuinely required across the environment, and restrict or block it where business needs allow
- Strengthen controls around LNK and HTA files delivered via email and other collaboration channels
- Build detection logic around the combination of legitimate-tool abuse, persistence mechanisms and in-memory execution — not just known malware signatures
