Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
16
techniques
2
software
10,709
corpus matches
profile
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.
techniques
16 attributed · most-instrumented first
software
2 malware & tools attributed
Action RAT
S1028
AuTo Stealer
S1029
read this carefully
10,709 corpus matches is not attribution
That count is indicators which exhibit techniques SideCopy is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
discovery
+4 more techniques
showing 30 of 10,709