Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT

Cybersecurity researchers have disclosed details of a spear-phishing campaign likely undertaken by the Pakistan-aligned SideCopy group targeting Afghanistan’s Ministry of Finance with an open-source remote access trojan called Xeno RAT.

“The campaign opens with a spear phishing delivery – a ZIP archive containing a malicious LNK file bearing a carefully crafted Pashto-language filename,” Seqrite Labs researcher Dixit Panchal said in a technical breakdown of the activity.

Also targeted as part of the campaign are provincial revenue and finance directorates, Pashto-speaking government officials, and provincial-level government employees. The campaign has been codenamed Operation XENOFISCAL.

The choice of Pashto for the lure file is a deliberate choice on the part of the attacker, as it’s the main language spoken in the Afghan government circles. This aspect reflects the attacker’s familiarity with the target environment.

SideCopy is the name given to a Pakistan-linked threat group operating under the broader Transparent Tribe (aka APT36) umbrella, using a wide range of malware families to steal sensitive data from compromised hosts. In April 2025, the adversary was attributed to a set of attacks targeting various sectors in India with Xeno RAT, Spark RAT, and CurlBack RAT.

Viewed in that light, the latest campaign is a continuation of a broader cluster of malicious cyber activity aimed at South Asian entities.

Once executed, the Windows Shortcut (LNK) file leverages “mshta.exe” to fetch a remote HTML Application (HTA) from a compromised Afghan education domain, leading to the execution of obfuscated JavaScript in memory. The malware also establishes Registry-based persistence by mimicking Microsoft Edge, while dropping Xeno RAT 1.8.7 and a decoy document as a distraction mechanism by means of a DLL-based loader.

Xeno RAT is designed to connect with a remote server over TCP to handle commands sent by the operator. The malware is equipped to load and execute external DLL modules, transmit data to the server, launch the malware via a scheduled task, retrieve antivirus information, support SOCKS5 proxy-based network tunneling, perform file operations, log keystrokes, take screenshots, monitor the clipboard, track webcam/microphone, delete persistence methods, and uninstall itself from the host.