Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT

Why It Matters

The intrusion exposes critical Afghan financial data to a state‑aligned threat actor, heightening geopolitical cyber risk across South Asia. It underscores the need for hardened email defenses and rapid incident response in government ministries.

Key Takeaways

• SideCopy used Pashto‑named LNK file to lure Afghan finance officials
• Campaign deployed Xeno RAT 1.8.7 with DLL loader and Edge mimic persistence
• Operation XENOFISCAL expands Transparent Tribe’s focus from India to Afghanistan
• Malware communicates via TCP, supports SOCKS5 tunneling and keystroke logging
• Researchers warn of broader targeting of South Asian government entities

Pulse Analysis

The emergence of SideCopy’s Operation XENOFISCAL reflects a shifting cyber‑espionage playbook in South Asia, where threat groups increasingly tailor lures to local languages and bureaucratic structures. By aligning the malicious payload with Pashto terminology, the actors demonstrate deep reconnaissance of Afghan governmental workflows, a tactic previously observed in attacks against Indian defense procurement channels. This cultural tailoring raises the bar for detection, as conventional signature‑based filters often miss such context‑specific artifacts.

Technically, the campaign combines classic Windows shortcut abuse with modern persistence tricks. The LNK file invokes mshta.exe to fetch an HTA from a compromised education domain, executing obfuscated JavaScript that drops Xeno RAT 1.8.7 via a DLL loader. The RAT establishes TCP command‑and‑control, supports SOCKS5 tunneling, and mimics Microsoft Edge in the registry to survive reboots. Its capabilities—keylogging, screenshot capture, webcam access, and self‑deletion—equip operators to exfiltrate financial records, personnel data, and strategic policy documents.

For Afghan ministries and neighboring governments, the incident signals an urgent need to reinforce email hygiene, enforce multi‑factor authentication, and segment critical networks. Threat intelligence sharing across the region can help identify similar lures before they reach end users. As Transparent Tribe expands its focus beyond India, stakeholders must adopt behavior‑based detection and regular red‑team exercises to anticipate culturally engineered attacks, thereby reducing the risk of sensitive fiscal information falling into hostile hands.