SideCopy
- ID
- G1008
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.[1]
Techniques used (16)
- T1016 System Network Configuration Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1059.005 Visual Basic
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1204.002 Malicious File
- T1218.005 Mshta
- T1518 Software Discovery
- T1518.001 Security Software Discovery
- T1566.001 Spearphishing Attachment
- T1574.001 DLL
- T1584.001 Domains
- T1598.002 Spearphishing Attachment
- T1608.001 Upload Malware
- T1614 System Location Discovery