SideCopy Group Uses LNK Shortcuts to Install ReverseRAT on Windows Systems
Indian authorities warn that the SideCopy hacker group targets organizations with phishing emails that deploy a medium-severity remote access tool via malicious shortcuts.
Key points
- The campaign targets Indian organizations and academic institutions using spear-phishing emails containing weaponized ZIP archives.
- Trellix researchers identified a multistage infection chain that uses legitimate Windows utilities to execute an in-memory payload.
- The ReverseRAT malware can capture screenshots, steal passwords, and allow operators to run commands on compromised endpoints.
Indian authorities issued a warning on October 15, 2026, stating that the SideCopy hacker group is targeting organizations and academic institutions within the country. These attackers use spear-phishing emails to deploy ReverseRAT, a remote access tool that operates on Windows systems. The advisory classifies the threat as medium severity, noting that the malware is designed to steal passwords, capture screen images, and gather other sensitive information from victims.
How does the infection start?
The intrusion typically begins with a phishing email that contains a weaponized ZIP archive as an attachment. Inside this archive, attackers place a malicious LNK shortcut file. This shortcut is designed to look like a standard document, featuring a misleading filename and a spoofed PDF icon to trick users into opening it. When a recipient clicks the shortcut, it triggers the initial stage of the attack chain by retrieving additional malicious content from the internet.
What happens after the shortcut is opened?
Opening the shortcut causes the system to download an obfuscated HTML Application, or HTA, from attacker-controlled servers at docsportal[.]in. The Windows operating system executes this script using mshta.exe, a legitimate system utility. This allows the attackers to use a trusted program as a host for their malicious code. The HTA then embeds a dynamic link library file named ne4snapk.dll, which loads into the running process through .NET deserialization.
How do attackers maintain access?
The ne4snapk.dll file acts as a dropper, extracting three compressed components: a batch file, a secondary HTA script, and a decoy Word document. To ensure the malware survives system restarts, the attackers create a Windows Registry Run key. This key launches the batch file whenever the affected user signs in. The script then runs the secondary HTA in the background, allowing the malware to persist without requiring further interaction from the victim.
What does the final payload do?
The secondary HTA script reconstructs its obfuscated payload and reflectively loads a file called ioluegnt.dll. Trellix researchers identified this component as the ReverseRAT remote access Trojan. It uses .NET deserialization to convert encoded content into an active payload that resides in memory. This technique reduces the chances of detection by traditional file-scanning tools, although the earlier stages of the attack do create script files and other artifacts on the disk.
What capabilities does ReverseRAT provide?
Once active, ReverseRAT gives attackers extensive access to the compromised endpoint. The malware can collect system metadata, details about installed software, and clipboard contents. Operators can also take screenshots, steal passwords, and execute commands on the system. The tool allows for file manipulation, uploading of additional content, and the initiation of shell sessions, enabling deep control over the infected machine.
Detection notes
Security teams should monitor for unusual executions of ms
Background: Remote access trojans
A remote access trojan is malware that grants unauthorized users full control of your device. It disguises itself as useful software, allowing attackers to steal data, record activity, and move laterally through networks. Detection requires monitoring for unusual outbound connections and validating all software sources.
Read the full guide: Remote Access Trojans: Definition, Mechanics, and Risk Reduction
What to do and how to stay safe
- Visual email clients hide the actual sender address behind friendly display names.
- Browser password managers can auto-fill credentials on fake login pages if not configured correctly.
- Mobile devices often strip security headers, making malicious links harder to detect than on desktops.
Phishing succeeds when you prioritize speed over verification. Always check the technical details before trusting the visual content.
Step-by-step guide: 7 Phishing Mistakes That Bypass Your Defenses
General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.
