Pakistan-Linked SideCopy Targets Afghanistan Finance Ministry with Xeno RAT

Pakistan-aligned SideCopy group has launched a targeted spear-phishing campaign against Afghanistan's Ministry of Finance using the open-source Xeno RAT malware.

• •The campaign uses ZIP archives with malicious LNK files containing Pashto-language filenames to target Afghan government officials and provincial finance directorates
• •The LNK file leverages mshta.exe to fetch a remote HTA from a compromised Afghan education domain, executing obfuscated JavaScript in memory
• •Xeno RAT 1.8.7 is deployed via a DLL-based loader with Registry-based persistence mimicking Microsoft Edge
• •Xeno RAT capabilities include TCP command-and-control communication, external DLL module loading, SOCKS5 proxy tunneling, keylogging, screenshot capture, clipboard monitoring, and webcam/microphone tracking
• •