Indian government agencies subjected to ReverseRAT backdoor attacks

Indian government agencies have been targeted by a spear-phishing campaign by the Pakistani threat group SideCopy distributing an updated ReverseRAT backdoor, The Hacker News reports. SideCopy's attacks involve the delivery of a macro-enabled Word file purporting to be an advisory from India's Ministry of Communications regarding security threats in Android devices and how to avoid them, a report from ThreatMon revealed. While most of the content in the file 'Cyber Advisory 2023.docm' was copied word for word, the document has macros, which when activated would prompt malicious code execution and ReverseRAT deployment into the system. "Once ReverseRAT gains persistence, it enumerates the victim's device, collects data, encrypts it using RC4, and sends it to the command-and-control (C2) server. It waits for commands to execute on the target machine, and some of its functions include taking screenshots, downloading and executing files, and uploading files to the C2 server," said the report.