Twitter Feed - nextronresearch - 17-06-2026

SideCopy, also tracked as APT36 or Transparent Tribe, has launched a new attack campaign targeting Indian defense personnel using a fake 'Minutes Of Meeting' document as lure. The attack employs an identical playbook to previous operations: a double-extension Minutes Of Meeting.docx.lnk file executes a PowerShell stager (pdfdocs.bat) from a nested pdfdocs folder while displaying a clean decoy document. The chain deploys a Remote Access Trojan (pdfdocs) that establishes persistence through the HKCU Run key. The staged components demonstrate low detection rates at initial delivery, with the decoy document scoring 0/66, the stager 1/61, and only the final executable reaching 35/71 detections.

• Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, AfghanistanMalware2026-05-29
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Hirudo: From Fake Updates to Patched Banking AppsMalware2026-10-14
• Uncovering a SectopRAT Variant Embedded in Legitimate SoftwareMalware2026-09-25
• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCHMalware2026-09-16