Pakistan-Linked SideCopy Group Targets Afghan Finance Ministry and Provincial Revenue Offices with XenoRAT Espionage Campaign

Seqrite Labs attributed Operation XENOFISCAL to SideCopy with medium-to-high confidence, targeting Afghanistan's Ministry of Finance and all 34 provincial revenue directorates with spear-phishing emails carrying a malicious LNK file with a Pashto-language filename disguised as a seminar document 123. Attackers routed delivery through abimj.edu.af, a compromised Afghan education domain hosted on the Ministry of Communication's subnet, using mshta.exe to execute an obfuscated HTA payload entirely in memory 23. XenoRAT 1.8.7 established persistence via a Registry Run key disguised as Microsoft Edge and a scheduled task, beaconing over encrypted TCP to a Frankfurt-based server on AS59711 previously tied to SideCopy infrastructure 13. Seqrite assessed the lure, an authentic MoF staff directory listing officials and phone numbers from all 34 provinces, as evidence of prior access to government networks 3.