Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance — Threadlinqs Intelligence
As of 2026-05-30, Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance is a high-severity apt threat attributed to SideCopy (Pakistan), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-0625 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: SideCopy · Pakistan · ESPIONAGE
A SideCopy spear-phishing campaign (medium-to-high confidence Pakistan-linked, Transparent Tribe/APT36 umbrella) targets the Afghan Ministry of Finance and provincial revenue directorates with a
Operation XENOFISCAL is an active cyber-espionage campaign documented by Seqrite Labs on 29 May 2026, attributed with medium-to-high confidence to SideCopy, a Pakistan-aligned threat cluster operating under the Transparent Tribe / APT36 umbrella. The campaign targets Pashto-speaking officials of the Islamic Emirate of Afghanistan's Ministry of Finance and the Provincial Revenue & Finance Directorates (Mustoufiats) across all 34 provinces. The operation name fuses 'Xeno' (the XenoRAT payload) with 'Fiscal' (the Ministry of Finance target).
Initial access is via a spear-phishing ZIP containing a Pashto-named malicious LNK ('List of Employees Who Were Introduced to the Intellectual and Psychological Warfare Seminar'). The LNK invokes mshta.exe from C:\Windows\System32 to retrieve a remote HTA from hxxp://abimj.edu.af/index.php. Critically, the delivery domain abimj.edu.af resolves to 103.132.98.224 and 103.132.98.226 within block 103.132.98.0/23 belonging to AS58469 (Afghan Ministry of Communication and Information Technology) — a deliberate infrastructure-blending technique that places adversary staging on legitimate Afghan government IP space.
The HTA carries heavily obfuscated JavaScript that reconstructs a serialized .NET object using System.Security.Cryptography.FromBase64Transform and a custom Base64 decoder (avoiding native atob), then triggers a .NET BinaryFormatter.Deserialize() gadget chain (WPF XAML ObjectDataProvider/ResourceDictionary and Windows Forms AxHost/PropertyBagBinary). It checks the installed .NET runtime (v4.0.30319, falling back to v2.0.50727) and may pin the COMPLUS_Version environment variable. Deserialization loads the Stage-1 loader DLL WayBroad.dll, which drops and opens a decoy PDF (a genuine provincial finance staff directory listing Finance Directors, Revenue Chiefs, and their mobile numbers across 34 provinces), creates the staging directory C:\Users\Public\USOShared-1de48789-1285, writes a hidden noway.bat helper, and establishes persistence by writing the HKCU\...\CurrentVersion\Run value 'Edgre' pointing to the staged Stage-2 HTA zuidrt.hta.
zuidrt.hta repeats the deserialization technique to load the Stage-2 loader DLL Aotestpass.dll, which uses a second staging directory (C:\Users\Public\firefx-1de87eec8-1241), enables TLS 1.2 via ServicePointManager and downloads encrypted shellcode payloads (ayui.vmxx / ayhui.vmxx) over WebClient.DownloadFile, selecting OS-specific URLs (institute/10/ for Windows 7, institute/7/ otherwise). The payload is decoded via a Base64 -> GZipStream -> Base64 routine, written to RWX memory via VirtualAlloc(MEM_COMMIT, PAGE_EXECUTE_READWRITE), copied with Marshal.Copy, and executed with CreateThread plus WaitForSingleObject. The shellcode patches AmsiScanBuffer, hosts the .NET CLR (clr.dll/mscoree.dll), and reflectively loads the final XenoRAT 1.8.7 assembly via Assembly.Load.
The deployed payload is a customized XenoRAT 1.8.7 (open-source .NET RAT by moom825). It connects to C2 over encrypted TCP (AES with a shared key and fixed IV via CryptoStream) using Windows RTL compression APIs (RtlCompressBuffer/RtlDecompressBuffer), supports SOCKS5 tunneling, in-memory DLL plugin loading (DllNodeHandler -> Assembly.Load -> Run), keylogging, screen capture, clipboard monitoring, webcam/microphone surveillance, file management, antivirus enumeration (WMI root\SecurityCenter2), and self-uninstall. It guards execution with the mutex 'clouda' and persists via the scheduled task 'XenoUpdateManager' (when running with admin rights) or the HKCU Run key (non-admin). C2 is the operator-managed Windows host 185.235.137.106 on AS59711 (HZ Hosting Ltd, Bulgaria-registered with Frankfurt presence) — an ASN previously seen in SideCopy infrastructure clusters.
Attribution rests on multiple converging signals: the LNK->mshta->remote-HTA-via-index.php pattern is a documented SideCopy signature since 2019; Run-key persistence with a process name typosquatting a legitimate Windows componen
Weaknesses (CWE)
CWE-502, CWE-829
Target sectors: government, finance, public-administration
Target regions: Afghanistan, South Asia, Central Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, T1583.001, T1566.001, T1218.005, T1059.003, T1059.007, T1129, T1106, T1204.002, T1547.001, T1053.005