{ "id": "79298b58-d9da-493a-bf09-40a7702d9559", "created_at": "2026-04-06T00:19:17.423532Z", "updated_at": "2026-04-10T13:12:30.414472Z", "deleted_at": null, "sha1_hash": "1500f5428d8ad33d0ac2d7156ae56d38023f3504", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 64004, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:06:59 UTC\n APT group: SideCopy\nNames\nSideCopy (Seqrite)\nUNC2269 (Mandiant)\nWhite Dev 55 (PWC)\nMocking Draco (Palo Alto)\nTAG-140 (Recorded Future)\nG1008 (MITRE)\nCountry Pakistan\nMotivation Information theft and espionage\nFirst seen 2019\nDescription\n(Seqrite) Operation SideCopy is active from early 2019, till date.\nThis cyber-operation has been only targeting Indian defence forces and armed forces personnel.\nMalware modules seen are constantly under development and updated modules are released after a\nreconnaissance of victim data.\nActors are keeping track of malware detections and updating modules when detected by AV.\nAlmost all CnC belongs to Contabo GmbH and server names are similar to machine names found in the\nTransparent Tribe report.\nThis threat actor is misleading the security community by copying TTPs that point at SideWinder,\nRattlesnake APT group.\nWe suspect this threat actor has links with Transparent Tribe, APT 36 APT group.\nObserved Countries: India.\nTools used\nActionRAT, Allakore RAT, AresRAT, CetaRAT, DetaRAT, EpicenterRAT, Lilith RAT, MargulasRAT,\nnjRAT, ReverseRAT.\nOperations performed\nJul 2021\nInSideCopy: How this APT continues to evolve its arsenal\nFeb 2023\nAPT SideCopy Targeting Indian Government Entities\nMar 2023\nNotorious SideCopy APT group sets sights on India’s DRDO\nOct 2023\nSideCopy’s Multi-platform Onslaught: Leveraging WinRAR Zero-Day and Linux Variant o\nAres RAT\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=9fd705e5-6b3c-4e0b-b21c-ebb9dc854fc3\nPage 1 of 2\n\nDec 2024\nGoodbye HTA, Hello MSI: New TTPs and Clusters of an APT driven by Multi-Platform\nAttacks\nMar 2025\nDRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal\nCounter operations Aug 2021\nTaking Action Against Hackers in Pakistan and Syria\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9fd705e5-6b3c-4e0b-b21c-ebb9dc854fc3\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=9fd705e5-6b3c-4e0b-b21c-ebb9dc854fc3\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/showcard.cgi?u=9fd705e5-6b3c-4e0b-b21c-ebb9dc854fc3" ], "report_names": [ "showcard.cgi?u=9fd705e5-6b3c-4e0b-b21c-ebb9dc854fc3" ], "threat_actors": [ { "id": "187a0668-a968-4cf0-8bfd-4bc97c02f6dc", "created_at": "2022-10-27T08:27:12.955905Z", "updated_at": "2026-04-10T02:00:05.376527Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [ "SideCopy" ], "source_name": "MITRE:SideCopy", "tools": [ "AuTo Stealer", "Action RAT" ], "source_id": "MITRE", "reports": null }, { "id": "fce5181c-7aab-400f-bd03-9db9e791da04", "created_at": "2022-10-25T15:50:23.759799Z", "updated_at": "2026-04-10T02:00:05.3002Z", "deleted_at": null, "main_name": "Transparent Tribe", "aliases": [ "Transparent Tribe", "COPPER FIELDSTONE", "APT36", "Mythic Leopard", "ProjectM" ], "source_name": "MITRE:Transparent Tribe", "tools": [ "DarkComet", "ObliqueRAT", "njRAT", "Peppy" ], "source_id": "MITRE", "reports": null }, { "id": "5cdcbec3-d174-440f-a2e1-75d86143a1a3", "created_at": "2026-02-07T02:00:03.66831Z", "updated_at": "2026-04-10T02:00:03.963444Z", "deleted_at": null, "main_name": "TAG-140", "aliases": [], "source_name": "MISPGALAXY:TAG-140", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d0c0a5ea-3066-42a5-846c-b13527f64a3e", "created_at": "2023-01-06T13:46:39.080551Z", "updated_at": "2026-04-10T02:00:03.206572Z", "deleted_at": null, "main_name": "RAZOR TIGER", "aliases": [ "APT-C-17", "T-APT-04", "SideWinder" ], "source_name": "MISPGALAXY:RAZOR TIGER", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "a4f0e383-f447-4cd6-80e3-ffc073ed4e00", "created_at": "2023-01-06T13:46:39.30167Z", "updated_at": "2026-04-10T02:00:03.280161Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [], "source_name": "MISPGALAXY:SideCopy", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b584b10a-7d54-4d05-9e21-b223563df7b8", "created_at": "2022-10-25T16:07:24.181589Z", "updated_at": "2026-04-10T02:00:04.892659Z", "deleted_at": null, "main_name": "SideCopy", "aliases": [ "G1008", "Mocking Draco", "TAG-140", "UNC2269", "White Dev 55" ], "source_name": "ETDA:SideCopy", "tools": [ "ActionRAT", "AllaKore", "Allakore RAT", "AresRAT", "Bladabindi", "CetaRAT", "DetaRAT", "EpicenterRAT", "Jorik", "Lilith", "Lilith RAT", "MargulasRAT", "ReverseRAT", "njRAT" ], "source_id": "ETDA", "reports": null }, { "id": "6b9fc913-06c6-4432-8c58-86a3ac614564", "created_at": "2022-10-25T16:07:24.185236Z", "updated_at": "2026-04-10T02:00:04.893541Z", "deleted_at": null, "main_name": "SideWinder", "aliases": [ "APT-C-17", "APT-Q-39", "BabyElephant", "G0121", "GroupA21", "HN2", "Hardcore Nationalist", "Rattlesnake", "Razor Tiger", "SideWinder", "T-APT-04" ], "source_name": "ETDA:SideWinder", "tools": [ "BroStealer", "Capriccio RAT", "callCam" ], "source_id": "ETDA", "reports": null }, { "id": "abb24b7b-6baa-4070-9a2b-aa59091097d1", "created_at": "2022-10-25T16:07:24.339942Z", "updated_at": "2026-04-10T02:00:04.944806Z", "deleted_at": null, "main_name": "Transparent Tribe", "aliases": [ "APT 36", "APT-C-56", "Copper Fieldstone", "Earth Karkaddan", "G0134", "Green Havildar", "Mythic Leopard", "Opaque Draco", "Operation C-Major", "Operation Honey Trap", "Operation Transparent Tribe", "ProjectM", "STEPPY-KAVACH", "Storm-0156", "TEMP.Lapis", "Transparent Tribe" ], "source_name": "ETDA:Transparent Tribe", "tools": [ "Amphibeon", "Android RAT", "Bezigate", "Bladabindi", "Bozok", "Bozok RAT", "BreachRAT", "Breut", "CapraRAT", "CinaRAT", "Crimson RAT", "DarkComet", "DarkKomet", "ElizaRAT", "FYNLOS", "Fynloski", "Jorik", "Krademok", "Limepad", "Luminosity RAT", "LuminosityLink", "MSIL", "MSIL/Crimson", "Mobzsar", "MumbaiDown", "Oblique RAT", "ObliqueRAT", "Peppy RAT", "Peppy Trojan", "Quasar RAT", "QuasarRAT", "SEEDOOR", "Scarimson", "SilentCMD", "Stealth Mango", "UPDATESEE", "USBWorm", "Waizsar RAT", "Yggdrasil", "beendoor", "klovbot", "njRAT" ], "source_id": "ETDA", "reports": null }, { "id": "c68fa27f-e8d9-4932-856b-467ccfe39997", "created_at": "2023-01-06T13:46:38.450585Z", "updated_at": "2026-04-10T02:00:02.980334Z", "deleted_at": null, "main_name": "Operation C-Major", "aliases": [ "APT36", "APT 36", "TMP.Lapis", "COPPER FIELDSTONE", "Storm-0156", "Transparent Tribe", "ProjectM", "Green Havildar", "Earth Karkaddan", "C-Major", "Mythic Leopard" ], "source_name": "MISPGALAXY:Operation C-Major", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "173f1641-36e3-4bce-9834-c5372468b4f7", "created_at": "2022-10-25T15:50:23.349637Z", "updated_at": "2026-04-10T02:00:05.3486Z", "deleted_at": null, "main_name": "Sidewinder", "aliases": [ "Sidewinder", "T-APT-04" ], "source_name": "MITRE:Sidewinder", "tools": [ "Koadic" ], "source_id": "MITRE", "reports": null } ], "ts_created_at": 1775434757, "ts_updated_at": 1775826750, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/1500f5428d8ad33d0ac2d7156ae56d38023f3504.pdf", "text": "https://archive.orkl.eu/1500f5428d8ad33d0ac2d7156ae56d38023f3504.txt", "img": "https://archive.orkl.eu/1500f5428d8ad33d0ac2d7156ae56d38023f3504.jpg" } }