{"id":41661,"date":"2021-07-08T07:58:08","date_gmt":"2021-07-08T07:58:08","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/india-under-attack-by-rapidly-evolving-advanced-persistent-threat-actor-sidecopy-says-cisco-talos\/"},"modified":"2021-07-08T07:58:08","modified_gmt":"2021-07-08T07:58:08","slug":"india-under-attack-by-rapidly-evolving-advanced-persistent-threat-actor-sidecopy-says-cisco-talos","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/india-under-attack-by-rapidly-evolving-advanced-persistent-threat-actor-sidecopy-says-cisco-talos\/","title":{"rendered":"India under attack by rapidly-evolving advanced persistent threat actor SideCopy, says Cisco Talos"},"content":{"rendered":"

Cisco\u2019s Talos security unit says it has detected an increased rate of attacks on targets on the Indian subcontinent and named an advanced persistent threat actor named SideCopy as the source.<\/p>\n

The outfit on Wednesday posted<\/a> that it has tracked \u201can increase in SideCopy\u2019s activities targeting government personnel in India using themes and tactics similar to APT36 (aka Mythic Leopard and Transparent Tribe)\u201d. SideCopy\u2019s infrastructure, Talos opined, \u201cindicates a special interest in victims in Pakistan and India,\u201d as the malware used only initiates actions if it detects infections in those two countries.<\/p>\n

The name SideCopy appears to have first been used by security firm Seqrite in a September 2020 analysis of<\/a> previous attacks on Indian military targets. Seqrite said it has seen SideCopy activity from 2019.<\/p>\n