APT36 and SideCopy Target Indian Entities with Cross-Platform RAT Campaigns

APT36 and SideCopy, both linked to Pakistan, have been conducting cyber espionage campaigns against Indian defense and government-aligned organizations. These campaigns utilize remote access trojans (RATs) such as Geta RAT, Ares RAT, and DeskRAT to compromise both Windows and Linux environments. The attacks have been ongoing since at least 2019, showcasing a persistent threat to national security.

The attack methodology involves phishing emails containing malicious attachments or links that lead to malware installation. For instance, one attack chain uses a malicious LNK file to invoke ‘mshta.exe’ and execute an HTML Application (HTA) file, which then downloads and executes the RAT. This multi-stage process is designed to evade detection while providing attackers with persistent access to compromised systems.

Geta RAT, for example, can collect system information, capture screenshots, and harvest data from USB devices, while Ares RAT operates similarly on Linux systems, utilizing a Go binary to download its payload. DeskRAT, another variant, is delivered via rogue PowerPoint Add-In files, demonstrating the diverse tactics employed by these threat actors.

Implications for Cybersecurity

The ongoing campaigns by APT36 and SideCopy underscore the importance of vigilance among organizations in the defense and strategic sectors. The use of sophisticated techniques and a variety of malware families indicates a well-resourced threat actor focused on espionage.

Organizations should be particularly wary of phishing attempts that leverage defense-themed lures and impersonated official documents. This highlights the need for robust email filtering and user education to recognize and report suspicious communications.

Furthermore, the ability of these RATs to adapt their persistence methods based on installed security products suggests that organizations must regularly update and monitor their security solutions. Continuous threat assessment and incident response planning are essential to mitigate risks associated with such advanced persistent threats.

Overall, the activities of APT36 and SideCopy reflect a broader trend of increasing cyber threats targeting critical infrastructure and government entities, necessitating a proactive approach to cybersecurity.

• Geta RAT is a malware that provides remote access and can execute various commands on infected systems.
• Ares RAT is a Linux-based malware that can run commands and harvest sensitive data.
• DeskRAT is delivered through malicious PowerPoint Add-Ins and establishes communication with remote servers.