SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.1
- MalwareBytes SideCopy Dec 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1614 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1584.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2022 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1016 | System Network Configuration Discovery | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1059.005 | Visual Basic | — |
| T1082 | System Information Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1518 | Software Discovery | — |
| T1518.001 | Security Software Discovery | — |
| T1566.001 | Spearphishing Attachment | — |
| T1574.001 | DLL | — |
| T1584.001 | Domains | — |
| T1598.002 | Spearphishing Attachment | — |
| T1608.001 | Upload Malware | — |
| T1614 | System Location Discovery | — |
Aliases
SideCopy
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.