APT36 and SideCopy Launch Cross-Platform RAT Campaigns Against Indian Entities

Indian defense and government-aligned organizations have been targeted by multiple espionage campaigns attributed to SideCopy and APT36 (Transparent Tribe) that deploy cross-platform remote access trojans—Geta RAT, Ares RAT, and DeskRAT—via phishing with malicious LNK/HTA files, PowerPoint Add-Ins, and Golang/Python loaders; the malware enables reconnaissance, credential and data theft, command execution, and long-term persistence across Windows and Linux hosts.