Adversary Intelligence — 2026-06-01

Pakistan-Linked SideCopy APT Deploys XenoRAT Against Afghanistan Finance Ministry and Provincial Revenue Offices

BLUFSideCopy's simultaneous targeting of all 34 provincial revenue directorates signals systematic fiscal intelligence collection for Islamabad, and the group will very likely strike additional Afghan government networks within 120 days.

Seqrite Labs identified a spear-phishing campaign attributed to SideCopy at medium-to-high confidence against Afghanistan's Ministry of Finance and all 34 provincial revenue directorates, deploying XenoRAT 1.8.7 1. The lure is a ZIP containing an LNK bearing a Pashto-language filename referencing a psychological warfare seminar; execution drops a decoy MoF staff directory listing Finance Directors, Revenue Chiefs, and direct mobile numbers in Dari and Pashto 123. The infection chain abuses mshta.exe to fetch an HTA payload from compromised Afghan education domain abimj[.]edu[.]af, establishes Registry persistence via a typosquatted "Edgre" Edge entry, and patches AmsiScanBuffer for fileless XenoRAT delivery 13. XenoRAT beacons over AES-encrypted TCP to Frankfurt bulletproof host 185.235.137.106, which Seqrite previously linked to SideCopy's prior infrastructure clusters 12.

Analysis
Simultaneous targeting of the central ministry and all 34 provincial revenue directorates signals systematic collection against IEA fiscal capacity, not opportunistic access. The decoy's personnel roster, which lists mobile numbers for Finance Directors and Revenue Chiefs across every province, implies prior internal MoF access predating this campaign. SideCopy will very likely conduct at least one additional intrusion against Afghan government networks within 120 days. That assessment carries low confidence: single-source technical reporting without signals or human corroboration. Attribution to SideCopy rather than the broader APT36 infrastructure pool may reflect vendor cluster definitions, not distinct operational cells. Whether follow-on intrusions confirm active access or this campaign proves isolated changes the urgency for MoF officers deciding whether to rotate personnel credentials across all 34 provinces.

3 sources

Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan - Seqrite
SideCopy APT Deploys XenoRAT to Target Afghanistan Finance Ministry - Cyber Security News
SideCopy Deploys Persistent XenoRAT Against Afghanistan Finance Ministry - GBHackers