SideCopy - G1008

Created: 2022-08-07T13:52:07.791Z

Modified: 2022-10-24T18:51:09.213Z

Contributors: Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

SideCopy

Description

SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.(Citation: MalwareBytes SideCopy Dec 2021)

Techniques Used

SideCopy has used compromised domains to host its malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

SideCopy has collected browser information from a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1598.002|Spearphishing Attachment|

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

SideCopy has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,IaaS|T1614|System Location Discovery|