H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Action RAT

[Action RAT](https://attack.mitre.org/software/S1028) is a remote access tool written in Delphi that has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 against Indian and Afghani government personnel.(Citation: MalwareBytes SideCopy Dec 2021)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Action RAT](https://attack.mitre.org/software/S1028) is a remote access tool written in Delphi that has been used by [SideCopy](https://attack.mitre.org/groups/G1008) since at least December 2021 against Indian and Afghani government personnel.(Citation: MalwareBytes SideCopy Dec 2021)

Labels

malware
13 recorded

Relationships

uses
to Data from Local System
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to File and Directory Discovery
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Security Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
uses
from SideCopy
Group
2 external

References

mitre-attack
S1028
open
MalwareBytes SideCopy Dec 2021
https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance