THREAT_ACTOR · G1008
SideCopy
Also known as: SideCopy
Profile
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.
MITRE ATT&CK ↗Techniques
16 ATT&CK techniques attributed to this actor.
T1016 System Network Configuration DiscoveryT1036.005 Match Legitimate Resource Name or LocationT1059.005 Visual BasicT1082 System Information DiscoveryT1105 Ingress Tool TransferT1106 Native APIT1204.002 Malicious FileT1218.005 MshtaT1518 Software DiscoveryT1518.001 Security Software DiscoveryT1566.001 Spearphishing AttachmentT1574.001 DLLT1584.001 DomainsT1598.002 Spearphishing AttachmentT1608.001 Upload MalwareT1614 System Location Discovery
Software
2 malware/tools attributed to this actor.
Action RATAuTo Stealer
Related corpus activity
9,479 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to SideCopy.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2026-0740 | cve | — | 85 | 1 |
Showing the top 30 by severity of 9,479.