Loading story…
A Pakistan-linked espionage group tracked as SideCopy targeted Afghanistan’s Ministry of Finance, provincial finance and revenue offices, and other Pashto-speaking officials with spear-phishing emails that delivered the open-source remote access trojan XenoRAT. Seqrite said the campaign, dubbed Operation XENOFISCAL, used Pashto-language seminar-themed lures and ZIP archives containing a malicious shortcut file disguised as an internal government document; one decoy was a genuine Ministry of Finance staff directory covering all 34 provinces, suggesting prior reconnaissance or earlier compromise of Afghan government networks.
The infection chain abused mshta.exe, obfuscated JavaScript, .NET loaders, and reflective loading to establish a largely fileless foothold, then maintained persistence through Windows Registry changes and a scheduled task. Researchers said the attackers used a compromised Afghan education domain and other Afghan government-hosted infrastructure to make traffic appear legitimate, while separating payload delivery from command-and-control servers hosted in Europe, including Frankfurt, to reduce detection. Seqrite attributed the activity to SideCopy with medium-to-high confidence and linked the operation to the group’s broader history of targeting South Asian government entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Seqrite attributed the Afghanistan-focused operation, dubbed Operation XENOFISCAL, to the Pakistan-linked SideCopy threat group with medium-to-high confidence. The assessment cited tailored Pashto lures, target selection, and infrastructure choices consistent with the actor’s tradecraft.
Seqrite identified a cyberespionage campaign targeting Afghanistan’s Ministry of Finance, provincial finance and revenue offices, and other Pashto-speaking government officials. The attackers used Pashto-language phishing lures and malicious archives to deploy XenoRAT through a multi-stage infection chain.
Seqrite released detections and a detailed set of indicators of compromise for the SideCopy campaign targeting Afghan finance entities. The publication was intended to support threat hunting and remediation by defenders.
Kaspersky said the latest wave of attacks against Russian organizations began in January 2026. This wave used Ravage following phishing-based initial access and multi-stage malware delivery.
The Ravage penetration-testing framework used in the Russian-targeting campaign was released on GitHub in September 2025. Kaspersky later observed it being repurposed in real-world intrusions.
Kaspersky reported that a previously unknown hacking group has been targeting Russian organizations since at least 2024. Victims included maritime universities, energy facilities, diplomatic missions, government agencies, and financial institutions.
Seqrite reported that the Pakistan-linked SideCopy group had been conducting an espionage campaign against Afghanistan’s government finance sector since at least May 2025. The operation used Pashto-language spear-phishing lures and a customized Xeno RAT in a sustained effort against finance-related government targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcexakep.ru
Open sourcetherecord.media
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a targeted phishing operation against **Afghan government employees** that impersonates official correspondence from the prime minister’s office and other ministries to trick recipients into opening a weaponized decoy document. The lure is designed to look like legitimate administrative/financial reporting instructions and includes forged signatures; once opened, it deploys **FalseCub** malware intended to collect and exfiltrate data from infected systems. The activity shows evidence of careful target research, including the collection of Afghan legal and administrative materials (e.g., ministry communications and related documents) that could be reused as future lures. The operation abused **GitHub** as temporary payload hosting, with a newly created account used to distribute malware before content was removed, and investigators linked the operator’s online persona (e.g., alias **“Afghan Khan”** / user `afghanking777000`) across platforms such as Pinterest and Dailymotion. Telemetry cited by researchers also pointed to Pakistan-linked artifacts (e.g., link creation/upload location) associated with the shortened URL redirecting victims to the GitHub-hosted payload. Reporting described the actor as **Nomad Leopard** (per SEQRITE Labs’ tracking) but did not provide a definitive attribution to a known state or established APT group.
Jun 29, 2026
Multiple reporting described **phishing-led intrusions** that establish long-term remote access on victim endpoints using a mix of commodity RATs and layered backdoors. Indian defense and government-aligned organizations were targeted in campaigns attributed to Pakistan-aligned clusters **APT36/Transparent Tribe** and **SideCopy**, using malicious attachments/links to deliver Windows and Linux payloads including **Geta RAT**, **Ares RAT**, and **DeskRAT**. One documented Windows chain used a malicious `LNK` that invoked `mshta.exe` to run a remote HTA, which then decrypted and launched a DLL payload, reflecting continued reliance on living-off-the-land binaries and multi-stage loaders to maintain persistence and enable data theft and post-compromise operations across platforms. Separately, a newly reported **CrashFix** campaign backdoored Windows by socially engineering users to run a command via the Windows Run dialog, then using Windows tools and in-memory scripts to deploy a primary **Python implant** plus additional Python scripts and a reflectively loaded DLL backdoor, followed by network mapping and **Active Directory** targeting—behavior consistent with interactive intrusion/access-brokerage tradecraft. FortiGuard Labs also detailed a phishing campaign delivering a new **XWorm** variant via a malicious Excel attachment exploiting `CVE-2018-0802` to fetch an HTA, trigger PowerShell, and load a fileless .NET module that uses process hollowing to inject XWorm into `Msbuild.exe`, alongside analysis of encrypted C2 traffic and plugin-based capabilities enabling full remote control of compromised Windows systems.
Jun 29, 2026
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Jun 29, 2026