MITRE ATT&CKgroup
G1008 SideCopy
- Domain
- enterprise
- Version
- 1.0
- Created
- 2022-08-07
Description
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.
Related
Uses · MITRE ATT&CK (18)
- S1028 Action RAT software (malware)
- S1029 AuTo Stealer software (malware)
- T1614 System Location Discovery technique
- T1608.001 Upload Malware sub-technique
- T1598.002 Spearphishing Attachment sub-technique
- T1584.001 Domains sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1218.005 Mshta sub-technique
- T1518 Software Discovery technique
- T1016 System Network Configuration Discovery technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
References
- https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure MalwareBytes SideCopy Dec 2021