A threat actor linked to Pakistan has been actively targeting various sectors in India using remote access trojans (RATs) such as Xeno RAT, Spark RAT, and a newly identified malware family called CurlBack RAT. This activity, detected in December 2024, marks an expansion of the group’s focus beyond traditional targets like government and defense to include entities in the railway, oil and gas, and external affairs ministries. SideCopy, suspected to be a sub-cluster within Transparent Tribe (APT36), mimics the attack chains of another threat actor, SideWinder, to deliver its payloads. Recently, the group has transitioned from using HTML Application (HTA) files to Microsoft Installer (MSI) packages as their primary staging mechanism, a notable shift in their approach. In previous attacks, SideCopy deployed obfuscated HTA files, a method also employed by SideWinder, leading to the deployment of various malware families including Action RAT, ReverseRAT, Cheex, a USB data siphoner, and the Geta RAT. These tools enable the theft of documents, browser data, and execution of remote commands. The group’s latest campaigns demonstrate maturity and sophistication, utilizing email-based phishing with lure documents to distribute malware. These documents range from railway staff holiday lists to cybersecurity guidelines from the Hindustan Petroleum Corporation Limited (HPCL). One cluster of activity targets both Windows and Linux systems, deploying Spark RAT and CurlBack RAT, the latter capable of collecting system information, downloading files, executing commands, elevating privileges, and listing user accounts. Another cluster uses decoy files to initiate multi-step infections that deliver a customized version of Xeno RAT.