SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · September 17, 2026

Introduction

The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware. While the primary objective of advanced persistent threat (APT) groups like SideCopy has historically been the surveillance and exfiltration of sensitive data from government officials and high-ranking personnel, their strategic scope has recently broadened to include academic institutions.

SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols. This delivery mechanism facilitates the deployment of a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure. 

Trellix ARC has been closely tracking SideCopy's tactical evolution, including this recent expansion in their targeting. In this blog, we will explore a recent campaign deploying their preferred remote access trojan and, more importantly, dissect the mshta.exe execution chain, key payloads, and the mechanisms used to establish long-term persistence.

Anatomy of an infection: SideCopy kill chain

Kill chain overview

1. Initial Access: Delivers a weaponized ZIP archive via spear-phishing to trick the user into a compromise.
2. The LNK Dropper: A deceptive shortcut uses spoofed icons to trigger the initial malicious script execution.
3. HTA Downloading: Fetches a remote HTA stager from the attacker's server to bridge the next phase of the attack.
4. Obfuscated HTA Staging: Deobfuscates scripts in memory to drop the persistence loader, the second-stage HTA, and a decoy document.
5. Persistence Mechanism: Modifies Windows Registry Run Keys to ensure the malware automatically restarts upon every reboot.
6. Living-off-the-Land (LotL): Exploits the .NET BinaryFormatter to bypass security and re-animate malicious objects in memory.
7. Memory Activation: Utilizes mshta.exe and .NET methods to launch the RAT payload without ever writing it to the physical disk.
8. Data Exfiltration: Transmits stolen screenshots, files, and credentials to the C2 server via encrypted channels.

Technical analysis: SideCopy campaign lifecycle

1. Initial access

SideCopy gains initial access through spear-phishing campaigns that deliver weaponized ZIP archives. These archives contain a malicious .LNK file paired with a decoy GIF file. To enhance the social engineering lure, the .LNK file utilizes a PDF icon and deceptive naming conventions to masquerade as a legitimate DOCX document, misleading the victim into executing the initial infection stage.

2. The weaponized LNK

The weaponized LNK contains malicious URL https[:]//docsportal%2Ein/public/reps/com/161%2Ephp to download and execute a heavily obfuscated HTA file, identified as com.hta.

3. Downloading of secondary payload (HTA stager)

Upon execution, the LNK shortcut fetches an obfuscated HTA file from docsportal[.]in, caching it as com.hta in the standard Windows internet cache. Following successful execution, the malware employs an anti-forensic self-deletion routine by removing the HTA file from the disk once the subsequent infection stages are initialized. The HTA file contains an embedded ne4snapk.dll, and during execution the embedded DLL file is loaded into mshta.exe through a .NET deserialization attack.

4. Obfuscated HTA staging

Upon execution, the script deobfuscates and loads ne4snapk.dll, which serves as a dropper for three embedded components: a persistence loader (appT.bat), a secondary exploit stage (startT.hta), and a decoy document (commskl.docx) intended to misdirect the user. These files are stored in GZIP-compressed format. At runtime, the malware decompresses and drops these payloads onto the host filesystem. Once the environment is staged, the malware achieves persistence by modifying the Windows Registry, ensuring automated execution after every system reboot.

5. Persistence mechanism

The threat actor establishes reboot persistence by modifying the Windows Registry to trigger a malicious batch file, i.e., appT.bat. This script serves as a persistent loader designed to launch the secondary HTA stage in a stealthy background process.

• Registry Modification: The adversary injected a value into the Windows Run Key (typically HKCU\Software\Microsoft\Windows\CurrentVersion\Run), pointing to C:\Users\Public\User\appT.bat.
• The Loader (appT.bat): This file contains a specific command designed to initialize the HTA environment without user interaction:
  start /b mshta.exe "C:\Users\Public\User\startT.hta"
• Stealth Execution: By utilizing the /b switch, the attacker ensures that mshta.exe runs the startT.hta file in the background without opening a new console window, significantly reducing the chance of manual detection by the user.

6. Living-off-the-land: .Net deserialization attack

The obfuscated code within startT.hta executes a multistage deobfuscation routine to reconstruct a two-part XAML payload directly in memory. Our analysis of this process identified the critical components responsible for the reflective loading of the primary malicious DLL. To evade disk-based detection, the malware decodes its core payload into volatile memory space, transitioning from a Base64-encoded string to an active, in-memory process via .NET Deserialization.

The following steps outline the abuse of specific .NET classes and functions during the infection chain:

• Base64 Decoding (mVfyZYlugN): The initial stage utilizes a custom routine to perform base64 decoding of the string.
• Memory Stream Conversion (DIVaHVNU): This utility function prepares the payload for execution through three specific technical steps:
• System.Text.ASCIIEncoding: Converts the decoded text into a raw byte array.
• System.Security.Cryptography.FromBase64Transform: Performs a secondary cryptographic transformation to unmask the final binary data.
• System.IO.MemoryStream: Ingests the resulting bytes into a virtual "file" in RAM, ensuring no malicious artifacts are written to the physical disk.
• Binary Object Reconstruction (BinaryFormatter): The malware leverages the System.Runtime.Serialization.Formatters.Binary.BinaryFormatter class to perform a deserialization attack.

Note: By abusing the deserialize method, the malware reconstructs the byte stream into a live object. Although Microsoft has officially categorized BinaryFormatter as obsolete due to its inherent security vulnerabilities, SideCopy continues to exploit it to achieve fileless code execution.

7. Payload activation in memory

Following the deserialization phase, the malware executes a reflective loading sequence to inject the malicious ioluegnt.dll directly into the memory space of the mshta.exe process. This "fileless" execution bypasses traditional disk-based security scanning by utilizing a series of .NET Reflection primitives:

• Assembly Ingestion: Using System.Reflection.Assembly.Load, the malware ingests the raw binary bytes of the RAT from memory, registering it as a valid module within the host application.
• Object Instantiation: The Activator.CreateInstance method is called to initialize the malicious object in memory.
• Initial Execution: Upon successful instantiation, the malware triggers the DoMainWork method within TestClass, and launches the RAT's operational capabilities.

8. Data exfiltration

SideCopy facilitates encrypted exfiltration via port 5863 to dns[.]educationportals[.]biz (resolved to 45[.]61[.]157[.]22). Although the actor utilizes AES encryption, the discovery of a hardcoded cryptographic key (NMXIKS09?:709,!~lnsYUS) allows defenders to decrypt and analyze C2 communications. Monitoring for this specific port and IP is highly recommended for immediate detection.

The IP address used for data exfiltration by the threat actors has also been seen in other malware campaigns in recent times.

Operational capabilities: Command and control matrix

The following table details the command set utilized by the threat actor to facilitate data exfiltration, remote execution, and persistence mechanisms.

Conclusion and general recommendations

The current activities of SideCopy underscore a disciplined and highly strategic approach to intelligence collection. While their historical focus has been on Indian government entities, their recent pivot toward academic institutions highlights an expanding set of strategic priorities.

Having maintained a high operational tempo over the past several years, the group has demonstrated significant multiplatform proficiency. Although their latest kill chains have been observed primarily on Windows, SideCopy is equally recognized for its ability to compromise Linux and Android environments. 

By continuously refining their infection stages, most notably through the heavy abuse of mshta.exe and complex, multilayered obfuscation, they remain a formidable and adaptive adversary for regional security.

• Email Security Gateways: Deploy advanced email filtering to intercept spear-phishing attempts. Configure the gateway to quarantine high-risk attachments—specifically LNK, ISO, and HTA files.
• Disable MSHTA: Block mshta.exe execution via AppLocker or reassociate .HTA files with Notepad to prevent accidental execution.
• Behavioral EDR: Implement EDR solutions that alert on anomalous process spawning, such as mshta.exe initiating network connections or launching PowerShell.
• Egress Filtering: Enforce strict firewall rules to block non-standard outbound ports (e.g., 5836) and known malicious IP ranges.
• Dynamic Sandboxing: Use signature-less analysis (e.g., Trellix IVX) to deconstruct multistage scripts in a secure environment.
• Network Traffic Monitoring: Implement deep packet inspection (DPI) to identify non-standard protocols and encrypted heartbeats. Monitor for persistent connections to uncommon ports (e.g., 5836) and utilize threat intelligence feeds to automatically sinkhole known SideCopy command and control (C2) domains.

Trellix protection against APT attacks: Recommended mitigation

Trellix provides a robust framework to dismantle the SideCopy kill chain. Trellix Email Security prevents initial access by blocking spear-phishing attempts and malicious LNK files. At the execution phase, Trellix EDR and Trellix IVX detect in-memory payloads and "living-off-the-land" maneuvers, stopping Ioluegnt.dll before it can establish a foothold. 

Finally, Trellix Network Security and Trellix Insights monitor for command and control activity, utilizing Trellix Global Threat Intelligence to detect encrypted communications on non-standard ports. Together, these solutions offer comprehensive coverage across delivery, execution, and exfiltration, significantly reducing the operational risk posed by stealthy, fileless espionage campaigns.

Indicators of compromise (IOCs)

Trellix detection coverage

References:

• https://x.com/PrakkiSathwik/status/1980995689208590764
• https://learn.microsoft.com/en-us/dotnet/api/system.runtime.serialization.formatters.binary.binaryformatter?view=net-10.0
• https://www.seqrite.com/blog/umbrella-of-pakistani-threats-converging-tactics-of-cyber-operations-targeting-india/
• https://www.seqrite.com/documents/en/white-papers/Seqrite-WhitePaper-Operation-SideCopy.pdf
• https://cyble.com/threat-actor-profiles/sidecopy/

Discover the latest cybersecurity research from the Trellix Advanced Research Center.