SideCopy targets Indian universities with ReverseRAT: data exfiltrated through port 5863

As reported by The Hacker News on 22 September 2026 on the basis of Trellix research, the attack chain begins with a weaponised ZIP archive. Inside the archive is a Windows shortcut (LNK) carrying a PDF icon and imitating a .DOCX extension; the shortcut downloads an encrypted HTML Application (HTA) from a remote server and runs it through mshta.exe, which in turn reflects a DLL payload into memory and launches ReverseRAT. The group has been active since at least 2019, a record of 7 years of activity. ReverseRAT itself has been in use since early 2021, roughly 5 years. SideCopy is also tracked under the name TAG-140 and overlaps with the Transparent Tribe cluster.

The technical indicators are concrete: collected data is sent through port 5863 to the address dns.educationportals[.]biz, which resolves to the IP address 45.61.157[.]22; the campaign uses the spoofed domain docsportal[.]in as a lure and encrypts command-and-control traffic with an embedded static key. ReverseRAT collects system information, lists of installed software, screenshots, passwords and clipboard contents; it performs file operations, runs commands, establishes persistence through the registry and opens a shell session.

The report gives no CVE number; the chain abuses Windows's legitimate mshta.exe tool rather than a software vulnerability, so there is no patch date in the classic sense. The number of institutions affected has not been disclosed and could not be independently verified. On the defensive side the only concrete measure is restricting script interpreters such as mshta.exe, PowerShell and cmd.exe through corporate policy.