Adversary Intelligence — 2026-05-30

Pakistan-Linked SideCopy APT Targets Afghan Finance Ministry With Persistent XenoRAT Implant

Seqrite Labs reported Friday a spear phishing campaign attributed with medium-to-high confidence to SideCopy, a Pakistan-linked APT under the Transparent Tribe/APT36 umbrella, targeting Afghanistan's Ministry of Finance and all 34 provincial revenue directorates 123. The lure was a Pashto-language LNK file framed as a seminar employee list, which dropped a decoy provincial staff directory listing Finance Directors, Revenue Chiefs, and direct mobile numbers in Dari and Pashto 13. A five-stage fileless chain staged through a compromised Afghan education domain, patched AmsiScanBuffer() to disable AMSI, and delivered XenoRAT 1.8.7 in memory with Registry persistence established under the typosquatting value "Edgre" 13. The implant beacons over AES-encrypted TCP to a Frankfurt bulletproof C2 server Seqrite previously tied to earlier SideCopy infrastructure clusters 13.

Analysis
SideCopy's systematic mapping of all 34 Afghan provincial revenue directorates signals intelligence collection against Taliban fiscal administration at operational depth. The lure's granularity, naming individual Finance Directors and Revenue Chiefs by mobile number, presupposes prior access or a well-placed human source within the target bureaucracy. Pakistan's strategic interest in monitoring Taliban revenue flows gives this targeting persistent logic that will outlast any single intrusion cycle. At least one additional publicly reported SideCopy intrusion targeting Afghan government networks is likely within 90 days. Confidence in this assessment is low; single-vendor reporting from Seqrite yields no independent attribution corroboration, and most Afghan government intrusions go unreported regardless of detection.

4 sources

Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan - Seqrite
SideCopy Deploys Persistent XenoRAT Against Afghanistan Finance Ministry - GBHackers
SideCopy APT Deploys XenoRAT to Target Afghanistan Finance Ministry - CyberPress
SideCopy APT Hackers Mimic as Government Personnel to Deploy Open-Source XenoRAT Tool - CyberSecurityNews