- Category
- State · Attributed to a state or working for one.
- Origin
- Pakistan(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1008 · 16 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0069 · sidecopy
PakistanWhat it is
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Fringe Leopard
- Mandiant
- UNC2269
- MITRE ATT&CK
- G1008
- PwC
- White Dev 55
- Recorded Future
- TAG-140
- Other names
- Mocking Draco
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTPakistan
- MISP Galaxy (CFR tagging)Pakistan
- ThreatActor.info (Malpedia et al.)Pakistan · high
Targets
- Countries
- India
Tools
The tools and malware families the sources tie to it.
- Action RAT
- AuTo Stealer
- Cyber Eye RAT
- CyberGate
- Remote Utilities
- RemoteCMD
- RemotePC
- Xploit
- drat
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de