SideCopy, a threat actor previously known for targeting government entities, has broadened its focus to academic institutions in India, according to a recent analysis by Trellix researchers.
The new campaign, identified by the security firm, employs spear‑phishing emails that embed malicious scripts and use the Windows utility mshta.exe to bypass standard security controls.
"SideCopy campaign operations typically initiate through spear‑phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," the researchers said.
Academic organisations in India, which often host large volumes of research data and student records, may be particularly vulnerable to such attacks, as the phishing lures aim to trick staff into opening infected attachments or links.
Security experts advise institutions to remain vigilant, verify email senders, and keep anti‑malware tools up to date to defend against this evolving threat.
<small>Source: The Hacker News — read the original story there.</small>
