Action RAT

MITRE ATT&CK: S1028 View on attack.mitre.org

Aliases: Action RAT

First seen
2021-12-01 00:00:00
Malware type
rat
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:21:30

Targeted industries: government-and-public-sector

Targeted regions: country_code:in country_code:af

Context

Action RAT is a remote access tool written in Delphi that has been used by SideCopy since at least December 2021 against Indian and Afghani government personnel.

Detection coverage

  • 386 Sigma rules

Malware & tools used

  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Web Protocols (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • Obfuscated Files or Information (attack-pattern)
  • System Information Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Data from Local System (attack-pattern)
  • Windows Command Shell (attack-pattern)

Used by threat actors

Reports & references

  • malwarebytes.com — Sidecopy Apt Connecting Lures To Victims Payloads To Infrastructure (report)
  • seqrite.com — Umbrella Of Pakistani Threats Converging Tactics Of Cyber Operations Targeting India (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Action Rat (report)
  • seqrite.com — Double Action Triple Infection And A New Rat Sidecopys Persistent Targeting Of Indian Defence (report)
  • seqrite.com — Sidecopys Multi Platform Onslaught Leveraging Winrar Zero Day And Linux Variant Of Ares Rat (report)
  • threatmon.io — Unraveling The Complex Infection Chain Analysis Of The Sidecopy Apts Attack Report (report)
  • MITRE ATT&CK — S1028 (report)

External references