In their latest campaign, threat actors from the SideCopy APT group have been explicitly targeting users working for India’s Defense Research and Development Organization (DRDO). The SideCopy APT group operates out of Pakistan and frequently targets entities throughout Southern Asia, including India and Afghan government entities. SideCopy was named as such due to their mirror-like infection chain of Sidewinder; a threat group operating in India. Additional reports also indicate some attribution to the Transparent Tribe (APT36) group who may be the parent organization of SideCopy. In this recent campaign, threat actors disseminate phishing campaigns to DRDO employees containing a URL to a supposed DRDO-related missile PowerPoint. However, upon visiting the link, users unknowingly download a malicious payload from the Action Rat malware family. The malware uses a variety of cloaking mechanisms such as changing the name of the file to avoid anti-virus detection. The malware itself establishes a connection to actor-controlled command-and-control (C2) servers where a bulk of user device data is uploaded. This data contains a variety of system information including device hostname, account username, operating system, and installed anti-virus applications. In addition to information gathering, the malware can remotely execute a list of commands to pull down additional payloads, gather additional file system documents, and obtain hardware information. CTIX analysts urge users to validate the integrity of email correspondence prior to visiting any embedded URL’s or downloading any attachments to lessen the risk for threat actor compromise.