SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling mshta.exe.^[1]

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.^[1]

SideCopy has used a malicious loader DLL file to execute the credwiz.exe process and side-load the malicious payload Duser.dll.^[1]

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.^[1]

SideCopy has used a legitimate DLL file name, Duser.dll to disguise a malicious remote access tool.^[1]

SideCopy has executed malware by calling the API function CreateProcessW.^[1]

SideCopy has sent spearphishing emails with malicious hta file attachments.^[1]

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.^[1]

SideCopy has collected browser information from a compromised host.^[1]

SideCopy uses a loader DLL file to collect AV product names from an infected host.^[1]

SideCopy has used compromised domains to host its malicious payloads.^[1]

SideCopy has utilized mshta.exe to execute a malicious hta file.^[1]

SideCopy has identified the OS version of a compromised host.^[1]

SideCopy has identified the country location of a compromised host.^[1]

SideCopy has identified the IP address of a compromised host.^[1]

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.^[1]