← threat actors
threat actor · PK
SideCopy
also tracked as transparent tribe 2, apt36 2, bitterapt 1, dropping elephant 1
6 stories · 6 in the wild · June 17, 2026 – September 23, 2026
evidence: 6 observed
how they got in
- phishing email 5 · Sep 23
sectors
- defense 4 · Sep 8
- education 1 · Sep 23
- government 1 · Aug 14
- transport 1 · Aug 14
geography
- india 4 · Sep 23
- china 1 · Jun 19
- pakistan 1 · Jun 19
malware and tools
- crimsonrat 4 · Sep 8
- reverserat 1 · Sep 23
- access accdr 1 · Aug 14
techniques
- phishing 1 · Sep 23
- lnk files 1 · Sep 8
- powershell 1 · Sep 8
- malware delivery 1 · Aug 14
- lnk loader 1 · Jun 19
- execution 1 · Jun 18
- spear phishing 1 · Jun 18
- luring 1 · Jun 17
attack phases seen
- Execution 6 · Sep 23
- Initial access 6 · Sep 23
what we reported, newest first, grouped by story
September 23, 2026
- SideCopy has extended its India targeting to academic institutions, using spear-phishing that abuses
mshta.exe to execute scripts and deliver ReverseRAT, per Trellix (The Hacker News).
· Sep 23 · observed · via phishing email · Threat Activity & Breaches
September 8, 2026
- SideCopy / Transparent Tribe activity against Indian defence targets continues with the same LNK plus BAT/PowerShell tradecraft. Qihoo 360's Advanced Threat Research Institute published further CrimsonRAT samples and a separate Go-based RAT, with infrastructure reuse across both campaigns (360 ATRI report).
· Sep 8 · observed · as transparent tribe · Threat Activity
August 14, 2026
- SideCopy delivering CrimsonRAT via Outlook
.msg lures, and BitterAPT using malicious .accdr documents against government, defense, and maritime targets — both flagged by Nextron with fresh IOCs. (SideCopy, BitterAPT)
· Aug 14 · observed · via phishing email · as bitterapt · Threat Activity
June 19, 2026
- Dropping Elephant has run one continuous China-themed LNK loader line for three-plus years (44 samples, 2023–2026) delivering an in-memory RAT via PDF-masquerading shortcuts and hidden PowerShell stagers (Rapid7, Nextron); SideCopy (APT36) swapped in a "Minutes Of Meeting" double-extension
.lnk lure dropping a .NET RAT with HKCU Run persistence (Nextron).
· Jun 19 · observed · via phishing email · as dropping elephant · Nation-State & APT
Jun 17 – June 18, 2026 · 2 reports
- SideCopy (APT36 / Transparent Tribe) continues its double-extension LNK → PowerShell → CrimsonRAT chain against Indian defense, swapping lures between fake PowerPoint briefings and Word "Minutes of Meeting" docs; staged components barely register at delivery. IOCs via Nextron (Nextron).
· Jun 18 · observed · via phishing email · as apt36, transparent tribe · Threat Activity & Ransomware
- SideCopy / APT36 (Transparent Tribe) targeted Indian defense personnel with a weaponized PowerPoint package and a double-extension
.pptx.lnk shortcut launching a .NET CrimsonRAT loader. Nextron Research.
· Jun 17 · observed · via phishing email · as apt36 · Threat Activity