Pakistan-Linked Side Copy Targets Afghanistan Finance Ministry with Xeno RAT
Summary: Researchers at Seqrite Labs disclosed a spear-phishing campaign, codenamed Operation XENOFISCAL and attributed to the Pakistan-linked SideCopy group, that targets Afghanistan's Ministry of Finance and provincial revenue and finance directorates with a ZIP archive containing a malicious LNK file bearing a Pashto-language filename. The LNK file uses mshta.exe to fetch a remote HTA from a compromised Afghan education domain, runs obfuscated JavaScript in memory, establishes Registry-based persistence mimicking Microsoft Edge, and drops Xeno RAT 1.8.7 plus a decoy document via a DLL-based loader.
Why it matters: Xeno RAT gives the operator keystroke logging, screenshots, clipboard monitoring, webcam and microphone access, SOCKS5 tunneling, and the ability to uninstall itself from the host - capabilities aimed at a national finance ministry and the officials who staff it.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026