Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance
Operation XENOFISCAL (TL-2026-0625), also tracked as Operation XENOFISCAL, is a high-severity advanced persistent threat campaign, first published 2026-05-29 and last reviewed 2026-09-01. It is attributed to SideCopy (Pakistan) with medium confidence, affects Microsoft Windows, maps to 32 MITRE ATT&CK techniques (T1012, T1027, T1027.011), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-0625
- Threat ID
- TL-2026-0625
- Also known as
- Operation XENOFISCAL, XENOFISCAL
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- 2026-05-29
- Last reviewed
- 2026-09-01
- Attribution
- SideCopy
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Pakistan
- Motivation
- ESPIONAGE
- Target sectors
- government, finance, public-administration
- Target regions
- Afghanistan, South Asia, Central Asia
- Detection rules
- 9
- Indicators of compromise
- 33
- Updates
- 2026-09-01 · revalidated 1× · latest source
Malware and tooling in Operation XENOFISCAL
Malware and tooling: XenoRAT, XenoRAT encrypted TCP (AES fixed-IV, RTL compression, SOCKS5)
A SideCopy spear-phishing campaign (medium-to-high confidence Pakistan-linked, Transparent Tribe/APT36 umbrella) targets the Afghan Ministry of Finance and provincial revenue directorates with a Pashto-themed LNK lure. The chain abuses mshta.exe to fetch a remote HTA from a staging domain blended onto Afghan government IP space, runs a multi-stage .NET BinaryFormatter deserialization loader chain, and reflectively injects a customized XenoRAT 1.8.7 in-memory for espionage. C2 is encrypted TCP to 185.235.137.106 on HZ Hosting (AS59711).
How Operation XENOFISCAL works
Operation XENOFISCAL is an active cyber-espionage campaign documented by Seqrite Labs on 29 May 2026, attributed with medium-to-high confidence to SideCopy, a Pakistan-aligned threat cluster operating under the Transparent Tribe / APT36 umbrella. The campaign targets Pashto-speaking officials of the Islamic Emirate of Afghanistan's Ministry of Finance and the Provincial Revenue & Finance Directorates (Mustoufiats) across all 34 provinces. The operation name fuses 'Xeno' (the XenoRAT payload) with 'Fiscal' (the Ministry of Finance target).
Initial access is via a spear-phishing ZIP containing a Pashto-named malicious LNK ('List of Employees Who Were Introduced to the Intellectual and Psychological Warfare Seminar'). The LNK invokes mshta.exe from C:\Windows\System32 to retrieve a remote HTA from hxxp://abimj.edu.af/index.php. Critically, the delivery domain abimj.edu.af resolves to 103.132.98.224 and 103.132.98.226 within block 103.132.98.0/23 belonging to AS58469 (Afghan Ministry of Communication and Information Technology) — a deliberate infrastructure-blending technique that places adversary staging on legitimate Afghan government IP space.
The HTA carries heavily obfuscated JavaScript that reconstructs a serialized .NET object using System.Security.Cryptography.FromBase64Transform and a custom Base64 decoder (avoiding native atob), then triggers a .NET BinaryFormatter.Deserialize() gadget chain (WPF XAML ObjectDataProvider/ResourceDictionary and Windows Forms AxHost/PropertyBagBinary). It checks the installed .NET runtime (v4.0.30319, falling back to v2.0.50727) and may pin the COMPLUS_Version environment variable. Deserialization loads the Stage-1 loader DLL WayBroad.dll, which drops and opens a decoy PDF (a genuine provincial finance staff directory listing Finance Directors, Revenue Chiefs, and their mobile numbers across 34 provinces), creates the staging directory C:\Users\Public\USOShared-1de48789-1285, writes a hidden noway.bat helper, and establishes persistence by writing the HKCU\...\CurrentVersion\Run value 'Edgre' pointing to the staged Stage-2 HTA zuidrt.hta.
zuidrt.hta repeats the deserialization technique to load the Stage-2 loader DLL Aotestpass.dll, which uses a second staging directory (C:\Users\Public\firefx-1de87eec8-1241), enables TLS 1.2 via ServicePointManager and downloads encrypted shellcode payloads (ayui.vmxx / ayhui.vmxx) over WebClient.DownloadFile, selecting OS-specific URLs (institute/10/ for Windows 7, institute/7/ otherwise). The payload is decoded via a Base64 -> GZipStream -> Base64 routine, written to RWX memory via VirtualAlloc(MEM_COMMIT, PAGE_EXECUTE_READWRITE), copied with Marshal.Copy, and executed with CreateThread plus WaitForSingleObject. The shellcode patches AmsiScanBuffer, hosts the .NET CLR (clr.dll/mscoree.dll), and reflectively loads the final XenoRAT 1.8.7 assembly via Assembly.Load.
The deployed payload is a customized XenoRAT 1.8.7 (open-source .NET RAT by moom825). It connects to C2 over encrypted TCP (AES with a shared key and fixed IV via CryptoStream) using Windows RTL compression APIs (RtlCompressBuffer/RtlDecompressBuffer), supports SOCKS5 tunneling, in-memory DLL plugin loading (DllNodeHandler -> Assembly.Load -> Run), keylogging, screen capture, clipboard monitoring, webcam/microphone surveillance, file management, antivirus enumeration (WMI root\SecurityCenter2), and self-uninstall. It guards execution with the mutex 'clouda' and persists via the scheduled task 'XenoUpdateManager' (when running with admin rights) or the HKCU Run key (non-admin). C2 is the operator-managed Windows host 185.235.137.106 on AS59711 (HZ Hosting Ltd, Bulgaria-registered with Frankfurt presence) — an ASN previously seen in SideCopy infrastructure clusters.
Attribution rests on multiple converging signals: the LNK->mshta->remote-HTA-via-index.php pattern is a documented SideCopy signature since 2019; Run-key persistence with a process name typosquatting a legitimate Windows component matches prior SideCopy tradecraft; staging on legitimate government IP space and reuse of HZ Hosting echo known SideCopy clusters; and Seqrite confirmed in December 2024 that SideCopy formally adopted customized XenoRAT variants (after earlier AsyncRAT use). Naming consistency between the delivery path 'cloudiyaf' and the RAT mutex/startup string 'clouda' suggests a single operator managing both infrastructure tiers.
MITRE ATT&CK techniques used in TL-2026-0625
Discovery
T1012 Query Registry; T1082 System Information Discovery; T1518.001 Security Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.011 Fileless Storage; T1055 Process Injection; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Collection
T1056.001 Keylogging; T1113 Screen Capture; T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture
Execution
T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1129 Shared Modules; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer; T1573.001 Symmetric Cryptography
stealth
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
defense-impairment
Affected products and versions in Operation XENOFISCAL
- Microsoft — Windows
Vulnerable versions: 7; 10; 11; Server - Islamic Emirate of Afghanistan — Ministry of Finance / Provincial Revenue & Finance Directorates (Mustoufiats)
Vulnerable versions: All 34 provincial directorates
Remediation for Operation XENOFISCAL
Immediate actions
- Block C2 IP 185.235.137.106 (AS59711 / HZ Hosting) at perimeter firewalls and proxies
- Block/sinkhole the delivery domain abimj.edu.af and monitor for resolution to 103.132.98.224 / 103.132.98.226
- Hunt for the scheduled task 'XenoUpdateManager' and the HKCU\Software\Microsoft\Windows\CurrentVersion\Run value 'Edgre'
- Search endpoints for staging directories C:\Users\Public\USOShared-1de48789-1285 and C:\Users\Public\firefx-1de87eec8-1241 and the mutex 'clouda'
- Hash-block all nine documented SHA256 IOCs across EDR/AV
Workarounds
- Disable execution of .lnk files from email/archive download paths via attachment policy
- Block mshta.exe outbound network access at the host firewall
- Disable BinaryFormatter deserialization in managed environments where controllable
Longer-term hardening
- Deploy EDR with behavioral detection for mshta.exe spawning network connections and for in-memory .NET reflective loading
- Restrict or disable mshta.exe execution via WDAC/AppLocker where business needs allow
- Implement egress filtering and alert on long-lived encrypted TCP sessions to newly registered or low-reputation hosting (HZ Hosting AS59711)
- User awareness training for Pashto/Dari spear-phishing lures referencing official staff directories
Weaknesses (CWE) in Operation XENOFISCAL
CWE-502, CWE-829
Timeline of Operation XENOFISCAL
- Seqrite Labs confirms SideCopy formally adopted customized XenoRAT variants, expanding its open-source RAT arsenal beyond earlier AsyncRAT usage.
- SideCopy spear-phishing wave against Indian government and defense entities (Ministry of Defense lure dated 13 Jan 2025) using XenoRAT/SparkRAT/CurlBack and an HTA-to-MSI delivery shift — establishes actor lineage and XenoRAT customization pattern.
- Adversary stages delivery on abimj.edu.af resolving to 103.132.98.224/.226 within Afghan government IP block 103.132.98.0/23 (AS58469), and provisions XenoRAT C2 on 185.235.137.106 (AS59711, HZ Hosting).
- Pashto-themed spear-phishing ZIPs with malicious LNK ('staff seminar directory') distributed to Afghan Ministry of Finance and provincial revenue directorate officials; multi-stage .NET loader chain deploys XenoRAT 1.8.7 in-memory.
- As of 2026-05-29, Operation XENOFISCAL remains an active SideCopy/APT36 espionage campaign disclosed by Seqrite only one day prior, with live C2 (185.235.137.106, HZ Hosting AS59711) and delivery infra reported, no takedown or sinkhole. The Pakistan-linked actor stays undisrupted and highly active in 2026, and XenoRAT plus mshta/deserialization tradecraft (no CVE) is technique-based, not patchable away.
- Threat published to Threadlinqs Intelligence platform with full MITRE mapping, IOCs, and detection coverage.
- Seqrite Labs publishes Operation XENOFISCAL analysis with full attack-chain breakdown, attribution to SideCopy (medium-to-high confidence), and complete IOC set.
- The Hacker News, SC World, GBHackers, Cyber Security News, SOC Prime, BankInfoSecurity and other outlets republish and independently corroborate Seqrite's Operation XENOFISCAL findings.
- NSFOCUS Fuying Lab publishes its June 2026 APT Insights report, independently corroborating the campaign and characterizing it as the first known Pakistan-attributed cyber campaign against Afghanistan and the first SideCopy operation outside India.
Update history for TL-2026-0625
- 2026-09-01 — SideCopy APT Launches 'Operation Xenofiscal' Against Afghan Ministry of Finance with Persistent XenoRAT: What changed No escalation: severity (HIGH), exploitability (ACTIVE), status (ACTIVE), and attribution_confidence (MEDIUM) are all unchanged. NSFOCUS's June 2026 APT Insights report and a wave of trade-press coverage independently corrobora
Sources cited for Operation XENOFISCAL
- Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan
- SideCopy APT Poses as Government Personnel to Distribute Open-Source XenoRAT Tool
- SideCopy APT Hackers Impersonate Government Officials to Deploy Open-Source XenoRAT Tool
- XenoRAT — open-source .NET remote access tool (moom825)
- MITRE ATT&CK — SideCopy (G1008)
- MITRE ATT&CK — Transparent Tribe (G0134)
Threats related to Operation XENOFISCAL
Detection coverage for TL-2026-0625
As of 2026-09-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0625 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.