SideCopy
No sourced public emblem in this profile.
reference profile · reported nexus: PK (not nationality)
The SideCopy APT is a Pakistani threat actor that has been operating since at least 2019, mainly targeting South Asian countries and more specifically India and Afghanistan. Its name comes from its infection chain that tries to mimic that of the SideWinder APT. It has been reported that this actor has similarities with Transparent Tribe (APT36) and possibly is a subdivision of this actor. Cisco Talos and Seqrite have provided comprehensive reports on this actor’s activities.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.seqrite.com/blog/operation-sidecopy/
https://www.telsy.com/sidecopy-apt-from-windows-to-nix/
https://blog.talosintelligence.com/2021/07/sidecopy.html
https://about.fb.com/news/2021/11/taking-action-against-hackers-in-pakistan-and-syria/
https://sebdraven.medium.com/copy-cat-of-apt-sidewinder-1893059ca68d