INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Hackers Deploy Casbaneiro Banking Trojan via Spear-Phishing Attacks

| 2026-09-14 08:56 CRITICAL HIGH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
SideCopy, an advanced persistent threat (APT) group originating from Pakistan, has been observed using spear-phishing lures to target academic institutions in India since at least 2026. The targeted entities include Indian academia, with the latest attack documented on September 22, 2026. This marks a broadening of SideCopy's strategic focus beyond government entities. The attackers use reverseRAT Spear-Phishing campaigns that leverage [IOC HIDDEN • LOGIN REQUIRED] to execute malicious scripts and deploy a remote access trojan (RAT), which serves as the central pillar of their offensive infrastructure.
Technical Mitigations AI-generated
• Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Network Intrusion Prevention (ATT&CK mitigation for Phishing): Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 27 IoCs Create Free Account
dn•••••.biz
do•••••.in
ms•••••.exe
co•••••.docx
co•••••.docx
io•••••.dll
45.61.•••.•••
5a7666••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
bf92a2••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
430258••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
51503c••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Transparent TribeTransparent TribeSideCopySideCopy MetamorfoMetamorfo
Target & Sectors
SOUTH_ASIA SOUTH_ASIA governmentgovernment financefinance educationeducation
Incident Timeline
‎at least 2019
Threat actors from Pakistan, affiliated with the SideCopy APT group and overlapping with Transparent Tribe, have deployed the Casbaneiro banking Trojan since at least 2019.
threat_actor SideCopy
" Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.
source_region Pakistan
" Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.
organisation APT
" Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.
threat_actor Transparent Tribe
" Active since at least 2019, SideCopy (aka TAG-140) is an advanced persistent threat (APT) group that originates from Pakistan, and shares overlaps with the Transparent Tribe cluster.
‎early 2021
SideCopy has been using the ReverseRAT remote access trojan since early 2021 to facilitate data exfiltration, remote execution, and persistence.
threat_actor SideCopy
" The DLL is a remote access trojan named ReverseRAT, which has been put to use by SideCopy since early 2021 to facilitate data exfiltration, remote execution, and persistence.
tactic Exfiltration
" The DLL is a remote access trojan named ReverseRAT, which has been put to use by SideCopy since early 2021 to facilitate data exfiltration, remote execution, and persistence.
organisation ReverseRAT
" The DLL is a remote access trojan named ReverseRAT, which has been put to use by SideCopy since early 2021 to facilitate data exfiltration, remote execution, and persistence.
‎June 2026
Threat actors used an open-source remote access trojan called Xeno RAT in a spear-phishing campaign targeting Afghanistan's Ministry of Finance.
industry Finance
In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.
tactic Phishing
In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.
threat_actor SideCopy
In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.
target_region Afghanistan
In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.
organisation Ministry of Finance
In a report published in June 2026, Seqrite Labs attributed SideCopy to a spear-phishing campaign targeting Afghanistan's Ministry of Finance with an open-source remote access trojan called Xeno RAT.
‎2026/09/14
SideCopy threat actors used a spear-phishing campaign leveraging mshta.exe to execute malicious scripts and target academic institutions in India.
threat_actor SideCopy
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing.
 Ravie Lakshmanan  Sep 22, 2026 Malware / Cyber Espionage The threat actor known as SideCopy has been observed using spear-phishing lures to target academic institutions in India, expanding their strategic focus beyond government entities.
"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said in a technical report.
The harvested data is exfiltrated via port 5863 to "dns.educationportals[.]biz," which resolves to the IP address "45.61.157[.]22." "The current activities of SideCopy underscore a disciplined and highly strategic approach to intelligence collection," Trellix concluded.
organisation Academia With ReverseRAT Spear-
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing.
organisation Boggavarapu R S S Srinivas Gupta
"SideCopy campaign operations typically initiate through spear-phishing campaigns that leverage the abuse of mshta.exe to execute malicious scripts and circumvent standard security protocols," Trellix researchers Boggavarapu R S S Srinivas Gupta and Ravishankar N C said in a technical report.
infrastructure Windows
The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk") to make the malicious file look legitimate.
The DLL serves as a dropper for three embedded components - appT.bat, a batch script that's launched by means of a Windows Registry Run Key to execute "startT.hta" using "mshta.exe" without requiring user interaction startT.hta, a secondary exploit stage that contains the obfuscated final payload commskl.docx, a decoy document "The obfuscated code within startT.hta executes a multi-s…
organisation Trellix
The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk") to make the malicious file look legitimate.
organisation LNK
The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk") to make the malicious file look legitimate.
organisation PDF
The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk") to make the malicious file look legitimate.
organisation Victims Open Bank
When Victims Open Bank Websites.
organisation HTML Application
The LNK file is used to fetch an obfuscated HTML Application (HTA) from a remote server ("docsportal[.]in") and execute it using "mshta.exe," which then proceeds to reflectively load a DLL payload.
organisation HTA
The LNK file is used to fetch an obfuscated HTML Application (HTA) from a remote server ("docsportal[.]in") and execute it using "mshta.exe," which then proceeds to reflectively load a DLL payload.
organisation DLL
The LNK file is used to fetch an obfuscated HTML Application (HTA) from a remote server ("docsportal[.]in") and execute it using "mshta.exe," which then proceeds to reflectively load a DLL payload.
organisation a Windows Registry Run Key
The DLL serves as a dropper for three embedded components - appT.bat, a batch script that's launched by means of a Windows Registry Run Key to execute "startT.hta" using "mshta.exe" without requiring user interaction startT.hta, a secondary exploit stage that contains the obfuscated final payload commskl.docx, a decoy document "The obfuscated code within startT.hta executes a multi-s…
organisation XAML
…thout requiring user interaction startT.hta, a secondary exploit stage that contains the obfuscated final payload commskl.docx, a decoy document "The obfuscated code within startT.hta executes a multi-stage deobfuscation routine to reconstruct a two-part XAML payload directly in memory," Trellix explained, adding it's responsible for reflectively loading an embedded DLL ("ioluegnt.dll").
‎Sep 22, 2026
Threat actors deployed the Casbaneiro banking Trojan, designed to activate when victims access bank websites.
industry Finance
General Document Context
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
The latest attack chain documented by Trellix uses spear-phishing to deliver a weaponized ZIP archive, within which exists a Windows shortcut (LNK) with a spoofed PDF icon and a .DOCX extension ("commskll.docx.lnk") to make the malicious file look legitimate.
The DLL serves as a dropper for three embedded components - appT.bat, a batch script that's launched by means of a Windows Registry Run Key to execute "startT.hta" using "mshta.exe" without requiring user interaction startT.hta, a secondary exploit stage that contains the obfuscated final payload commskl.docx, a decoy document "The obfuscated code within startT.hta executes a multi-s…
Intelligence Sources
The Hacker News 2026-09-22
AlienVault OTX 2026-09-14