Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance

Key facts for XENOFISCAL SideCopy campaign

Detection coverage for XENOFISCAL SideCopy campaign

As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0625 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: XENOFISCAL XenoRAT Encrypted TCP C2 Beacon — C2 / Lateral Movement Phase

Detects Operation XENOFISCAL XenoRAT 1.8.7 C2: a persistent encrypted TCP channel (custom AES with shared key and fixed IV via CryptoStream, RTL-compressed, SOCKS5-capable) to 185.235.137.106 on AS59711 (HZ Hosting), plus a heuristic for long-lived fixed-cadence beacons on non-standard ports. Covers the intentionally-omitted functional implant via C2 telemetry.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype="stream:tcp" OR sourcetype="bro:conn:json" OR sourcetype="pan:traffic")
| where (dest_ip="185.235.137.106" OR cidrmatch("185.235.137.0/24",dest_ip)) OR (transport="tcp" AND dest_port>1024 AND NOT match(app,"(?i)http|tls|ssl|dns"))
| bin _time span=1m
| stats count as conns sum(bytes_out) as bytes_out sum(bytes_in) as bytes_in dc(_time) as active_minutes by src_ip, dest_ip, dest_port
| eval ratio=round(bytes_out/(bytes_in+1),2)
| where dest_ip="185.235.137.106" OR (active_minutes>=10 AND conns>=10 AND dest_port!=443 AND dest_port!=80)
| sort - conns

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == "185.235.137.106" or (RemoteIPType == "Public" and RemotePort !in (80,443,53))
| summarize conns=count(), firstSeen=min(Timestamp), lastSeen=max(Timestamp), ports=make_set(RemotePort), procs=make_set(InitiatingProcessFileName) by DeviceName, RemoteIP
| extend durationMin = datetime_diff('minute', lastSeen, firstSeen)
| where RemoteIP == "185.235.137.106" or (durationMin >= 10 and conns >= 10)
| sort by conns desc

Sigma

title: XENOFISCAL XenoRAT Encrypted TCP C2 Beacon (AES Fixed-IV)
id: 7c1f3e2a-9b40-4f51-8c2d-1a2b3c4d5e03
status: experimental
description: Detects Operation XENOFISCAL XenoRAT 1.8.7 C2 — long-lived encrypted TCP (custom AES shared key + fixed IV via CryptoStream, RTL-compressed, SOCKS5-capable) to operator C2 185.235.137.106 on AS59711 (HZ Hosting). T1573.001.
references:
    - https://www.seqrite.com/blog/operation-xenofiscal-sidecopy-deploying-persistent-xenorat-targeting-the-mof-afghanistan/
    - https://github.com/moom825/xeno-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/29
tags:
    - attack.command_and_control
    - attack.t1573.001
    - attack.t1095
    - attack.t1071.001
    - attack.t1090.002
logsource:
    category: firewall
detection:
    selection_ip:
        dst_ip:
            - '185.235.137.106'
    condition: selection_ip
falsepositives:
    - None for the hardcoded C2 IP. The beaconing heuristic variant may match legitimate long-lived TCP services — baseline destinations first.
level: critical

Tuning notes: Hardcoded C2 185.235.137.106 / AS59711 is high-fidelity — alert immediately. For variant hunting, tune beacon-cadence thresholds (active_minutes, conns) and exclude approved long-lived services.

• 🔒 XENOFISCAL .NET Deserialization Reflective Load — Exploitation Phase · unlock with TL Creds
• 🔒 XENOFISCAL RWX Shellcode Injection & AMSI Patch — Post-Exploitation Phase · unlock with TL Creds
• 🔒 XENOFISCAL XenoRAT C2 Channel, AV Enumeration & clouda Mutex — C2 / Lateral Movement Phase · unlock with TL Creds
• 🔒 XENOFISCAL HTA Staging & Custom Base64 Decode — Exploitation Phase · unlock with TL Creds
• 🔒 XENOFISCAL Persistence & clouda Mutex — Post-Exploitation Phase · unlock with TL Creds
• 🔒 XENOFISCAL AMSI Bypass, Reflective Load & Encrypted C2 — C2 / Defense Evasion Phase · unlock with TL Creds
• 🔒 XENOFISCAL mshta Remote HTA Retrieval — Exploitation Phase · unlock with TL Creds
• 🔒 XENOFISCAL Persistence — Run Key & Scheduled Task — Post-Exploitation Phase · unlock with TL Creds

Indicators of compromise for XENOFISCAL SideCopy campaign

As of 2026-09-01, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-0625.

Sample indicators (3 of 33)

• IP address: 185.235.137[.]106
• Domain: abimj[.]edu[.]af
• File hash: 194B912C242604D6F9A79369F22338C58A13CE0CC2ED280CE505075808BC2F14

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

How XENOFISCAL SideCopy campaign works

C2 is encrypted TCP to 185.235.137.106 on HZ Hosting (AS59711).

Operation XENOFISCAL is an active cyber-espionage campaign documented by Seqrite Labs on 29 May 2026, attributed with medium-to-high confidence to SideCopy, a Pakistan-aligned threat cluster operating under the Transparent Tribe / APT36 umbrella. The campaign targets Pashto-speaking officials of the Islamic Emirate of Afghanistan's Ministry of Finance and the Provincial Revenue & Finance Directorates (Mustoufiats) across all 34 provinces. The operation name fuses 'Xeno' (the XenoRAT payload) with 'Fiscal' (the Ministry of Finance target).

Initial access is via a spear-phishing ZIP containing a Pashto-named malicious LNK ('List of Employees Who Were Introduced to the Intellectual and Psychological Warfare Seminar'). The LNK invokes mshta.exe from C:\Windows\System32 to retrieve a remote HTA from hxxp://abimj.edu.af/index.php. Critically, the delivery domain abimj.edu.af resolves to 103.132.98.224 and 103.132.98.226 within block 103.132.98.0/23 belonging to AS58469 (Afghan Ministry of Communication and Information Technology) — a deliberate infrastructure-blending technique that places adversary staging on legitimate Afghan government IP space.

The HTA carries heavily obfuscated JavaScript that reconstructs a serialized .NET object using System.Security.Cryptography.FromBase64Transform and a custom Base64 decoder (avoiding native atob), then triggers a .NET BinaryFormatter.Deserialize() gadget chain (WPF XAML ObjectDataProvider/ResourceDictionary and Windows Forms AxHost/PropertyBagBinary). It checks the installed .NET runtime (v4.0.30319, falling back to v2.0.50727) and may pin the COMPLUS_Version environment variable. Deserialization loads the Stage-1 loader DLL WayBroad.dll, which drops and opens a decoy PDF (a genuine provincial finance staff directory listing Finance Directors, Revenue Chiefs, and their mobile numbers across 34 provinces), creates the staging directory C:\Users\Public\USOShared-1de48789-1285, writes a hidden noway.bat helper, and establishes persistence by writing the HKCU\...\CurrentVersion\Run value 'Edgre' pointing to the staged Stage-2 HTA zuidrt.hta.

zuidrt.hta repeats the deserialization technique to load the Stage-2 loader DLL Aotestpass.dll, which uses a second staging directory (C:\Users\Public\firefx-1de87eec8-1241), enables TLS 1.2 via ServicePointManager and downloads encrypted shellcode payloads (ayui.vmxx / ayhui.vmxx) over WebClient.DownloadFile, selecting OS-specific URLs (institute/10/ for Windows 7, institute/7/ otherwise). The payload is decoded via a Base64 -> GZipStream -> Base64 routine, written to RWX memory via VirtualAlloc(MEM_COMMIT, PAGE_EXECUTE_READWRITE), copied with Marshal.Copy, and executed with CreateThread plus WaitForSingleObject. The shellcode patches AmsiScanBuffer, hosts the .NET CLR (clr.dll/mscoree.dll), and reflectively loads the final XenoRAT 1.8.7 assembly via Assembly.Load.

The deployed payload is a customized XenoRAT 1.8.7 (open-source .NET RAT by moom825). It connects to C2 over encrypted TCP (AES with a shared key and fixed IV via CryptoStream) using Windows RTL compression APIs (RtlCompressBuffer/RtlDecompressBuffer), supports SOCKS5 tunneling, in-memory DLL plugin loading (DllNodeHandler -> Assembly.Load -> Run), keylogging, screen capture, clipboard monitoring, webcam/microphone surveillance, file management, antivirus enumeration (WMI root\SecurityCenter2), and self-uninstall. It guards execution with the mutex 'clouda' and persists via the scheduled task 'XenoUpdateManager' (when running with admin rights) or the HKCU Run key (non-admin). C2 is the operator-managed Windows host 185.235.137.106 on AS59711 (HZ Hosting Ltd, Bulgaria-registered with Frankfurt presence) — an ASN previously seen in SideCopy infrastructure clusters.

Attribution rests on multiple converging signals: the LNK->mshta->remote-HTA-via-index.php pattern is a documented SideCopy signature since 2019; Run-key persistence with a process name typosquatting a legitimate Windows component matches prior SideCopy tradecraft; staging on legitimate government IP space and reuse of HZ Hosting echo known SideCopy clusters; and Seqrite confirmed in December 2024 that SideCopy formally adopted customized XenoRAT variants (after earlier AsyncRAT use). Naming consistency between the delivery path 'cloudiyaf' and the RAT mutex/startup string 'clouda' suggests a single operator managing both infrastructure tiers.

MITRE ATT&CK techniques by tactic:

Discovery

T1012 Query Registry; T1082 System Information Discovery; T1518.001 Security Software Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1027.011 Fileless Storage; T1055 Process Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Collection

T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture

Execution

T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1129 Shared Modules; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090.002 External Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography

stealth

T1218.005 Mshta

Initial Access

T1566.001 Spearphishing Attachment

Resource Development

T1583.001 Domains

defense-impairment

T1685 Disable or Modify Tools

Remediation for XENOFISCAL SideCopy campaign

Immediate actions

• Block C2 IP 185.235.137.106 (AS59711 / HZ Hosting) at perimeter firewalls and proxies
• Block/sinkhole the delivery domain abimj.edu.af and monitor for resolution to 103.132.98.224 / 103.132.98.226
• Hunt for the scheduled task 'XenoUpdateManager' and the HKCU\Software\Microsoft\Windows\CurrentVersion\Run value 'Edgre'
• Search endpoints for staging directories C:\Users\Public\USOShared-1de48789-1285 and C:\Users\Public\firefx-1de87eec8-1241 and the mutex 'clouda'
• Hash-block all nine documented SHA256 IOCs across EDR/AV

Workarounds

• Disable execution of .lnk files from email/archive download paths via attachment policy
• Block mshta.exe outbound network access at the host firewall
• Disable BinaryFormatter deserialization in managed environments where controllable

Longer-term hardening

• Deploy EDR with behavioral detection for mshta.exe spawning network connections and for in-memory .NET reflective loading
• Restrict or disable mshta.exe execution via WDAC/AppLocker where business needs allow
• Implement egress filtering and alert on long-lived encrypted TCP sessions to newly registered or low-reputation hosting (HZ Hosting AS59711)
• User awareness training for Pashto/Dari spear-phishing lures referencing official staff directories

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: 7; 10; 11; Server
• Islamic Emirate of Afghanistan — Ministry of Finance / Provincial Revenue & Finance Directorates (Mustoufiats)
  Vulnerable versions: All 34 provincial directorates

Timeline of XENOFISCAL SideCopy campaign

Last updated 2026-09-01 · revalidated 1× · latest source

• 2024-12-01 Seqrite Labs confirms SideCopy formally adopted customized locked-ioc-31 variants, expanding its open-source RAT arsenal beyond earlier AsyncRAT usage.
• 2025-01-13 SideCopy spear-phishing wave against Indian government and defense entities (Ministry of Defense lure dated 13 Jan 2025) using locked-ioc-31/SparkRAT/CurlBack and an HTA-to-MSI delivery shift — establishes actor lineage and locked-ioc-31 customization pattern.
• 2026-05-01 Adversary stages delivery on locked-ioc-28 resolving to locked-ioc-25/.226 within Afghan government IP block locked-ioc-24 (AS58469), and provisions locked-ioc-31 C2 on locked-ioc-23 (AS59711, HZ Hosting).
• 2026-05-20 Pashto-themed spear-phishing ZIPs with malicious LNK ('staff seminar directory') distributed to Afghan Ministry of Finance and provincial revenue directorate officials; multi-stage .NET loader chain deploys locked-ioc-27 in-memory.
• 2026-05-29 As of 2026-05-29, Operation XENOFISCAL remains an active SideCopy/APT36 espionage campaign disclosed by Seqrite only one day prior, with live C2 (locked-ioc-23, HZ Hosting AS59711) and delivery infra reported, no takedown or sinkhole. The Pakistan-linked actor stays undisrupted and highly active in 2026, and locked-ioc-31 plus mshta/deserialization tradecraft (no CVE) is technique-based, not patchable away.
• 2026-05-29 Threat published to Threadlinqs Intelligence platform with full MITRE mapping, IOCs, and detection coverage.
• 2026-05-29 Seqrite Labs publishes Operation XENOFISCAL analysis with full attack-chain breakdown, attribution to SideCopy (medium-to-high confidence), and complete IOC set.
• 2026-06-01 The Hacker News, SC World, GBHackers, Cyber Security News, SOC Prime, BankInfoSecurity and other outlets republish and independently corroborate Seqrite's Operation XENOFISCAL findings.
• 2026-09-01 NSFOCUS Fuying Lab publishes its June 2026 APT Insights report, independently corroborating the campaign and characterizing it as the first known Pakistan-attributed cyber campaign against Afghanistan and the first SideCopy operation outside India.

Update history

• 2026-09-01 — SideCopy APT Launches 'Operation Xenofiscal' Against Afghan Ministry of Finance with Persistent locked-ioc-31: What changed No escalation: severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution_confidence (MEDIUM) are all unchanged. NSFOCUS's June 2026 APT Insights report and a wave of trade-press coverage independently corrobora

Sources cited for XENOFISCAL SideCopy campaign

• Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan seqrite.com · Vendor report · 2026-05-29
• MITRE ATT&CK — SideCopy (G1008) MITRE · Research · 2026-05-29
• MITRE ATT&CK — Transparent Tribe (G0134) MITRE · Research · 2026-05-29
• XenoRAT — open-source .NET remote access tool (moom825) GitHub · Code repository · 2024-01-01
• SideCopy APT Poses as Government Personnel to Distribute Open-Source XenoRAT Tool cyberpress.org · News · 2026-05-29
• SideCopy APT Hackers Impersonate Government Officials to Deploy Open-Source XenoRAT Tool gbhackers.com · News · 2026-05-29

Threats related to XENOFISCAL SideCopy campaign

• Cyble H1 2026 Threat Actor Landscape: 261 Tracked Groups, Five Most Active Actors Profiled

More from SideCopy

• NSFOCUS Monthly APT Insights August 2026: Lazarus MISTPEN/ForestTiger/RelayShell Campaign with CVE-2026-68820, UAC-0099 LUNCHPOKE/BURNYBEAR/MATCHBOIL.V2, CVE-2026-42897 Exchange OWA Exploitation
• SideCopy Targets Indian Organizations with ReverseRAT via Spear-Phishing LNK/HTA Chain
• Operation ShadowRecruit: APT36-Linked SheetAgent RAT Campaign Abuses ControlR RMM and Google Sheets C2 to Target Indian Government Job Seekers

Previous and next in apt

• JINX-0164 — Crypto-Targeting macOS AUDIOFIX RAT via LinkedIn Social Engineering and Internal CI/CD Hijacking (Wiz CIRT) Previous report
• Stock Exchange Executive Mailbox Espionage — Five-Month Intrusion via Masquerading SYSTEM Binaries (armsvc.exe / oneservice.exe), Aspose-Based OST Theft, and Dropbox/OneDrive C2 & Exfiltration Next report

Further reading

• APT36/Transparent Tribe: Crimson RAT, CapraRAT