Last seven days
- First activity
- Sep 22, 2026
- Last activity
- Sep 22, 2026
- Feed role
- C2 / Distribution
- Host form
- 0 IP / 2 hostnames
ReverseRAT
ReverseRAT is a custom C# remote access trojan used by the Pakistan-linked SideCopy (TAG-140) threat cluster since at least early 2021.
Profile source: Mallory opens in a new tabReverseRAT
Family profile
ReverseRAT is a custom C# remote access trojan used by the Pakistan-linked SideCopy (TAG-140) threat cluster since at least early 2021. It has been deployed against Indian government, defense, critical-infrastructure, and academic targets, commonly through spear-phishing campaigns using weaponized archives, deceptive Windows shortcut lures, and HTML Application stages executed through mshta.exe. ReverseRAT supports host and installed-software discovery, screenshot capture, password and clipboard theft, file manipulation, command execution, file upload, and interactive shell access. It can establish Registry-based persistence and uses encrypted command-and-control communications. Observed infection chains employ staged payload delivery, reflective DLL loading, in-memory reconstruction and execution, obfuscation, and artifact deletion to hinder file-based detection. ReverseRAT also supports downloading and executing additional payloads, self-updating, and self-termination.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Reconnaissance
Observed infrastructure
Reported operators
Threat actors
2 named in public reportingDLL-датотеката е Remote Access Trojan (RAT) наречен ReverseRAT, кој SideCopy го користи уште од почетокот на 2021 година за овозможување извлекување податоци, далечинско извршување и одржување постојан пристап.
DLL-датотеката е Remote Access Trojan (RAT) наречен ReverseRAT, кој SideCopy го користи уште од почетокот на 2021 година за овозможување извлекување податоци, далечинско извршување и одржување постојан пристап.
MITRE ATT&CK
ReverseRAT in ATT&CK
21 distinct techniquesTechniques
21 techniques T1620 Reflective Code Loading T1218.005 Mshta T1113 Screen Capture T1059 Command and Scripting Interpreter T1566.001 Spearphishing Attachment T1082 System Information Discovery T1027 Obfuscated Files or Information T1140 Deobfuscate/Decode Files or Information T1555 Credentials from Password Stores T1070.004 File Deletion T1036.007 Double File Extension T1547.001 Registry Run Keys / Startup Folder T1518 Software Discovery T1105 Ingress Tool Transfer T1041 Exfiltration Over C2 Channel T1571 Non-Standard Port T1115 Clipboard Data T1573 Encrypted Channel T1204.002 Malicious File T1036 Masquerading T1573.001 Symmetric Cryptography
Reporting
Research mentioning ReverseRAT
Sep 22
Mkd Cirt
SideCopy го проширува таргетирањето кон Индија и кон академскиот сектор преку spear-phishing со ReverseRAT | MKD-CIRT | Национален центар за одговор на компјутерски инциденти
Pakistan-linked APT group SideCopy (also tracked as TAG-140) has expanded beyond its established focus on Indian government and defense organizations to target Indian academic institutions. Spear-phishing emails deliver ZIP archives containing a Windows LNK shortcut masquerading as a DOCX/PDF document; opening it retrieves an HTA payload from docsportal[.]in and launches it using the legitimate mshta.exe utility. The multi-stage chain employs reflective DLL loading, .NET deserialization, in-memory payload execution, obfuscation, registry-based persistence, and self-deletion to limit file-based detection. The final ReverseRAT implant can collect system, user, credential, clipboard, and screenshot data; execute commands; manipulate files; open a shell; and exfiltrate data through encrypted C2 traffic over port 5863 to dns.educationportals[.]biz, which resolves to 45.61.157[.]22.
Sep 22
The Hacker News
