TAG-140

APT Group ETDA ✓

Also Known As

No alias recorded

Target Countries

No target country recorded

Sectors Targeted

No targeted sector recorded

Details

Origin 🇵🇰 PK

Last Updated 21 Apr 2026

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 6 entries

SideCopy Seqrite

UNC2269 Mandiant

White Dev 55 PWC

Mocking Draco Palo Alto

TAG-140 Recorded Future

G1008 MITRE

Observed Target Countries 1

Based on ETDA data — countries highlighted in red

India

Description

(Seqrite) Operation SideCopy is active from early 2019, till date. This cyber-operation has been only targeting Indian defence forces and armed forces personnel. Malware modules seen are constantly under development and updated modules are released after a reconnaissance of victim data. Actors are keeping track of malware detections and updating modules when detected by AV. Almost all CnC belongs to Contabo GmbH and server names are similar to machine names found in the Transparent Tribe report. This threat actor is misleading the security community by copying TTPs that point at {{SideWinder, Rattlesnake}} APT group. We suspect this threat actor has links with {{Transparent Tribe, APT 36}} APT group.

Tools Used 10

ActionRAT Allakore RAT AresRAT CetaRAT DetaRAT EpicenterRAT Lilith RAT MargulasRAT njRAT ReverseRAT

Operations 6

2021-07 InSideCopy: How this APT continues to evolve its arsenal https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/591/original/062521_SideCopy_%281%29.pdf?1625657388

2023-02 APT SideCopy Targeting Indian Government Entities https://threatmon.io/apt-sidecopy-targeting-indian-government-entities/

2023-03 Notorious SideCopy APT group sets sights on India’s DRDO https://blog.cyble.com/2023/03/21/notorious-sidecopy-apt-group-sets-sights-on-indias-drdo/

2023-10 SideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT https://www.seqrite.com/blog/sidecopys-multi-platform-onslaught-leveraging-winrar-zero-day-and-linux-variant-of-ares-rat/

2024-12 Goodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform Attacks https://www.seqrite.com/blog/goodbye-hta-hello-msi-new-ttps-and-clusters-of-an-apt-driven-by-multi-platform-attacks/

2025-03 DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal https://go.recordedfuture.com/hubfs/reports/cta-2025-0623.pdf

Reports & References 2

https://www.seqrite.com/blog/operation-sidecopy/ https://blog.malwarebytes.com/threat-intelligence/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure/

ETDA Profile

SideCopy

Origin

Pakistan

First Seen 2019

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G1008/

View on ETDA APT Groups ↗