TAG-140 is a cyber threat actor group that overlaps with the publicly reported SideCopy group, which is widely believed to be a Pakistani state-aligned advanced persistent threat (APT) group. SideCopy is itself considered a sub-cluster or operational affiliate of Transparent Tribe (also tracked as APT36, ProjectM, or MYTHIC LEOPARD).
Key Characteristics
• Attribution: TAG-140 is assessed as a sub-cluster or affiliate of Transparent Tribe (APT36), with strong links to SideCopy.
• Active Since: At least 2019.
• Primary Targets: Indian government organizations, defense, maritime, and academic sectors, with recent expansion into railway, oil and gas, and external affairs ministries.
• Geographic Focus: India is the primary target, reflecting geopolitical motivations.
Tactics, Techniques, and Procedures (TTPs)
TAG-140 frequently uses spearphishing campaigns, often leveraging social engineering lures that spoof Indian government entities. Recent campaigns have included cloned press release portals of the Indian Ministry of Defence.
Delivery Methods: The group employs HTML applications (HTAs), Microsoft Installer (MSI) packages, and exploits software vulnerabilities (such as WinRAR flaws) to deliver payloads. TAG-140 rotates a variety of remote access trojans (RATs) and custom malware, including:
- DRAT (and DRAT V2)
- CurlBack
- SparkRAT
- AresRAT
- Xeno RAT
- AllaKore
- ReverseRAT
A typical infection involves a social engineering lure leading to execution of a malicious script (often via mshta.exe), which then launches a loader (such as BroaderAspect) that establishes persistence and deploys the final RAT payload.