SideCopy Uses XenoRAT in Phishing Campaign Against Afghan Finance Officials

A Pakistan-linked espionage group tracked as SideCopy targeted Afghanistan’s Ministry of Finance, provincial finance and revenue offices, and other Pashto-speaking officials with spear-phishing emails that delivered the open-source remote access trojan XenoRAT. Seqrite said the campaign, dubbed Operation XENOFISCAL, used Pashto-language seminar-themed lures and ZIP archives containing a malicious shortcut file disguised as an internal government document; one decoy was a genuine Ministry of Finance staff directory covering all 34 provinces, suggesting prior reconnaissance or earlier compromise of Afghan government networks.

The infection chain abused mshta.exe, obfuscated JavaScript, .NET loaders, and reflective loading to establish a largely fileless foothold, then maintained persistence through Windows Registry changes and a scheduled task. Researchers said the attackers used a compromised Afghan education domain and other Afghan government-hosted infrastructure to make traffic appear legitimate, while separating payload delivery from command-and-control servers hosted in Europe, including Frankfurt, to reduce detection. Seqrite attributed the activity to SideCopy with medium-to-high confidence and linked the operation to the group’s broader history of targeting South Asian government entities.