# Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry in Sophisticated Xeno RAT Campaign


## The Threat


Cybersecurity researchers have identified a targeted spear-phishing campaign attributed to SideCopy, a Pakistan-aligned threat group, actively compromising Afghanistan's Ministry of Finance and related government entities. The campaign, designated Operation XENOFISCAL, deploys the open-source remote access trojan Xeno RAT to establish persistent access to high-value targets within Afghan government finance infrastructure.


According to technical analysis from Seqrite Labs, the campaign demonstrates sophisticated operational security and linguistic sophistication, with attackers deliberately crafting lures in Pashto — the predominant language among Afghan government officials — to maximize social engineering effectiveness. Beyond the finance ministry, the attack surface extends to provincial revenue and finance directorates, Pashto-speaking government officials, and provincial-level government employees across Afghanistan.


The discovery represents a continuation of broader regional cyber espionage activities targeting South Asian entities and underscores the persistent threat landscape facing government infrastructure in unstable geopolitical contexts.


## Background and Context: SideCopy and Transparent Tribe


SideCopy operates as a sub-group within the larger Transparent Tribe (also tracked as APT36) umbrella — a Pakistani threat actor known for sophisticated data theft operations. The group has historically targeted government, military, and private sector entities across South Asia, with particular focus on India and Afghanistan.


### Historical Targeting Pattern


| Target Region | Primary Sectors | Known Malware Families |

|---|---|---|

| India | Military, Defense, Government | Xeno RAT, Spark RAT, CurlBack RAT |

| Afghanistan | Finance, Government | Xeno RAT |

| Regional | Broader South Asia | Multiple RAT variants |


In April 2025, SideCopy demonstrated similar operational patterns when targeting Indian sectors with a toolkit including Xeno RAT, Spark RAT, and CurlBack RAT. The current Afghanistan campaign reflects an evolution of this broader attack program, suggesting Transparent Tribe maintains sustained interest in government financial systems across the region.


The timing and targeting of Afghanistan's Finance Ministry is particularly significant given the country's strategic importance and the financial management challenges faced by the Afghan government — potentially making officials susceptible to credential theft and financial system compromise.


## Technical Details: The Infection Chain


Operation XENOFISCAL employs a methodical multi-stage infection chain designed to bypass email filters, evade endpoint detection, and maintain persistent access:


### Stage 1: Spear-Phishing Delivery

The attack initiates with a ZIP archive containing a malicious Windows Shortcut file (.LNK). The filename is crafted in Pashto script, a deliberate linguistic choice reflecting the attacker's deep familiarity with the target environment. This lure file serves as the initial infection vector, relying on social engineering to convince targets that the archive contains legitimate government documents.


### Stage 2: Living-Off-The-Land Execution

Upon execution, the LNK file invokes mshta.exe — a legitimate Microsoft HTML Application Host utility — to fetch a remote HTML Application (HTA) from a compromised Afghan education domain. This technique, known as "living-off-the-land," leverages trusted system binaries to bypass security controls.


The remote HTA contains obfuscated JavaScript that executes entirely in memory, avoiding disk-based detection signatures.


### Stage 3: Payload Deployment and Persistence

The JavaScript execution chain deploys Xeno RAT 1.8.7 via a DLL-based loader. The malware establishes persistence through Registry-based methods, deliberately mimicking Microsoft Edge configuration entries to blend with legitimate system artifacts.


A decoy document is simultaneously dropped — a distraction mechanism intended to convince targets that the file opened correctly and contained expected content, preventing them from reporting the infection or altering their behavior.


### Xeno RAT Capabilities


Once established, Xeno RAT provides the attacker with comprehensive remote control:


  • Command Execution: Handle arbitrary commands sent by remote operators
  • Module Loading: Load and execute external DLL modules dynamically
  • Data Exfiltration: Transmit sensitive data to command-and-control servers
  • Persistence: Launch malware automatically via Windows Scheduled Tasks
  • Reconnaissance: Retrieve antivirus information and system details
  • Network Tunneling: Support SOCKS5 proxy-based traffic routing
  • Surveillance: Keylogging, screenshot capture, clipboard monitoring
  • Hardware Access: Track webcam and microphone activity
  • Cleanup: Delete persistence artifacts and uninstall the malware

    • The RAT communicates with remote servers over TCP, maintaining bidirectional command channels controlled by the operator.


    ## Geopolitical Context and Regional Implications


    This campaign aligns with broader Transparent Tribe activity patterns across South Asia. In a related operation disclosed concurrently, researchers identified a targeted phishing campaign targeting Indian military infrastructure using weaponized Linux .desktop files. That campaign employed WhatsApp-based social engineering and contract-related lures associated with Indian-armored vehicle procurement — ultimately deploying a Golang-based ELF implant tracked as DeskRAT.


    The parallel targeting of both Afghan financial systems and Indian military infrastructure suggests Transparent Tribe operates a coordinated multi-vector campaign with distinct malware variants tailored to each target's operating environment (Windows for government officials, Linux for technical infrastructure personnel).


    ## Implications for Organizations


    ### Government Entities

    Afghan government officials and provincial administrators face immediate risk. The campaign's targeting of finance personnel suggests threat actors seek access to:

  • Government financial records and transaction data
  • Budgeting and appropriations information
  • Banking credentials and wire transfer authority
  • Treasury operations and asset management systems

    • ### Regional Risk

    Organizations operating across South Asia — particularly those in government, military, or finance sectors — should assume heightened exposure to Transparent Tribe operations. The group's demonstrated capability to:

  • Conduct linguistic reconnaissance (Pashto language targeting)
  • Compromise legitimate third-party domains (Afghan education servers)
  • Deploy multiple malware variants simultaneously
  • Maintain persistent command-and-control infrastructure

    • ...indicates a mature, well-resourced threat actor capable of sophisticated supply chain and infrastructure compromise.


    ### Broader Threat Landscape

    The use of open-source malware (Xeno RAT is publicly available) combined with sophisticated social engineering and living-off-the-land techniques demonstrates that advanced persistent threat capabilities are increasingly accessible to state-aligned groups with modest resources but high operational sophistication.


    ## Recommendations


    ### Immediate Actions


    For Afghan Government and Regional Entities:

  • Email Security: Deploy advanced email filtering with sandbox analysis to detect HTA and Pashto-language lure files
  • Endpoint Detection: Implement behavioral monitoring for mshta.exe spawning network connections
  • Registry Monitoring: Alert on Registry modifications mimicking Microsoft Edge configuration
  • Incident Response: Isolate and analyze any Windows Shortcut files received via email; preserve forensic evidence

    • For All Organizations:

  • Review and restrict usage of mshta.exe via Application Whitelisting policies
  • Implement credential guard solutions to prevent in-memory credential theft
  • Deploy SOCKS5 proxy monitoring to detect non-standard network tunneling
  • Conduct user awareness training emphasizing Pashto and region-specific social engineering tactics

    • ### Long-Term Resilience


  • Third-Party Risk Management: Audit educational and other infrastructure domains for compromise; implement domain monitoring
  • Malware Analysis: Develop organizational capability to analyze open-source RAT variants and tailor detection signatures
  • Supply Chain Security: Strengthen controls over software distribution channels and trusted domain usage
  • Geopolitical Intelligence: Integrate threat actor TTPs into security architecture planning, particularly for organizations operating across South Asia

    • ---


    ## HackWire Analysis


    The targeting of Afghanistan's Finance Ministry represents far more than a routine espionage operation — it signals a critical vulnerability window for government entities during periods of instability and transition. Afghan finance officials operate under severe resource constraints, often with limited access to modern security infrastructure, making them asymmetrically attractive targets for state-aligned threat actors.


    What's particularly striking is the linguistic sophistication and cultural intelligence embedded in this campaign. The deliberate choice of Pashto-language filenames indicates operators who conduct genuine target research rather than mass-phishing. This isn't opportunistic malware distribution; it's precision targeting that reflects months of operational planning.


    The concurrent disclosure of similar attacks on Indian military infrastructure using weaponized .desktop files reveals an important pattern: Transparent Tribe operates environment-specific attack variants. They deploy Windows RATs against government finance officials, Linux implants against military technicians, and region-tailored social engineering across all vectors. This level of operational discipline suggests a well-staffed APT with dedicated teams for different targeting verticals.


    For defenders, the sobering implication is that open-source RAT availability has democratized advanced access capabilities. Xeno RAT is freely available on GitHub; the advantage Transparent Tribe possesses isn't the malware itself, but the operational tradecraft, infrastructure, and persistence techniques that turn freely available code into a sophisticated espionage platform.


    Organizations in Afghanistan, Pakistan, and India should assume Transparent Tribe will escalate efforts during periods of geopolitical instability — such campaigns often precede or accompany broader political movements. Finance ministry targeting specifically suggests interest in sovereign wealth data, foreign reserves information, or banking relationships that could inform larger strategic intelligence collection.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)