# Operation XENOFISCAL — SideCopy (Transparent Tribe / APT36 umbrella) Deploys Persistent Customized XenoRAT 1.8.7 Against the Afghanistan Ministry of Finance

> A SideCopy spear-phishing campaign (medium-to-high confidence Pakistan-linked, Transparent Tribe/APT36 umbrella) targets the Afghan Ministry of Finance and provincial revenue directorates with a Pashto-themed LNK lure. The chain abuses mshta.exe to fetch a remote HTA from a staging domain blended onto Afghan government IP space, runs a multi-stage .NET BinaryFormatter deserialization loader chain, and reflectively injects a customized XenoRAT 1.8.7 in-memory for espionage. C2 is encrypted TCP to 185.235.137.106 on HZ Hosting (AS59711).

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-09-01T13:14:28.981Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0625
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-xenofiscal-sidecopy-campaign-tl-2026-0625.webp?v=0ff8a86e (Threadlinqs threat intel: SideCopy XENOFISCAL XenoRAT: Detection & IOCs (TL-2026-0625) — High severity, 33 IOCs, 9 detection rules.)
- **ID:** TL-2026-0625
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** SideCopy (Pakistan)
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)

## Description

Operation XENOFISCAL is an active cyber-espionage campaign documented by Seqrite Labs on 29 May 2026, attributed with medium-to-high confidence to SideCopy, a Pakistan-aligned threat cluster operating under the Transparent Tribe / APT36 umbrella. The campaign targets Pashto-speaking officials of the Islamic Emirate of Afghanistan's Ministry of Finance and the Provincial Revenue & Finance Directorates (Mustoufiats) across all 34 provinces. The operation name fuses 'Xeno' (the XenoRAT payload) with 'Fiscal' (the Ministry of Finance target).

Initial access is via a spear-phishing ZIP containing a Pashto-named malicious LNK ('List of Employees Who Were Introduced to the Intellectual and Psychological Warfare Seminar'). The LNK invokes mshta.exe from C:\Windows\System32 to retrieve a remote HTA from hxxp://abimj.edu.af/index.php. Critically, the delivery domain abimj.edu.af resolves to 103.132.98.224 and 103.132.98.226 within block 103.132.98.0/23 belonging to AS58469 (Afghan Ministry of Communication and Information Technology) — a deliberate infrastructure-blending technique that places adversary staging on legitimate Afghan government IP space.

The HTA carries heavily obfuscated JavaScript that reconstructs a serialized .NET object using System.Security.Cryptography.FromBase64Transform and a custom Base64 decoder (avoiding native atob), then triggers a .NET BinaryFormatter.Deserialize() gadget chain (WPF XAML ObjectDataProvider/ResourceDictionary and Windows Forms AxHost/PropertyBagBinary). It checks the installed .NET runtime (v4.0.30319, falling back to v2.0.50727) and may pin the COMPLUS_Version environment variable. Deserialization loads the Stage-1 loader DLL WayBroad.dll, which drops and opens a decoy PDF (a genuine provincial finance staff directory listing Finance Directors, Revenue Chiefs, and their mobile numbers across 34 provinces), creates the staging directory C:\Users\Public\USOShared-1de48789-1285, writes a hidden noway.bat helper, and establishes persistence by writing the HKCU\...\CurrentVersion\Run value 'Edgre' pointing to the staged Stage-2 HTA zuidrt.hta.

zuidrt.hta repeats the deserialization technique to load the Stage-2 loader DLL Aotestpass.dll, which uses a second staging directory (C:\Users\Public\firefx-1de87eec8-1241), enables TLS 1.2 via ServicePointManager and downloads encrypted shellcode payloads (ayui.vmxx / ayhui.vmxx) over WebClient.DownloadFile, selecting OS-specific URLs (institute/10/ for Windows 7, institute/7/ otherwise). The payload is decoded via a Base64 -> GZipStream -> Base64 routine, written to RWX memory via VirtualAlloc(MEM_COMMIT, PAGE_EXECUTE_READWRITE), copied with Marshal.Copy, and executed with CreateThread plus WaitForSingleObject. The shellcode patches AmsiScanBuffer, hosts the .NET CLR (clr.dll/mscoree.dll), and reflectively loads the final XenoRAT 1.8.7 assembly via Assembly.Load.

The deployed payload is a customized XenoRAT 1.8.7 (open-source .NET RAT by moom825). It connects to C2 over encrypted TCP (AES with a shared key and fixed IV via CryptoStream) using Windows RTL compression APIs (RtlCompressBuffer/RtlDecompressBuffer), supports SOCKS5 tunneling, in-memory DLL plugin loading (DllNodeHandler -> Assembly.Load -> Run), keylogging, screen capture, clipboard monitoring, webcam/microphone surveillance, file management, antivirus enumeration (WMI root\SecurityCenter2), and self-uninstall. It guards execution with the mutex 'clouda' and persists via the scheduled task 'XenoUpdateManager' (when running with admin rights) or the HKCU Run key (non-admin). C2 is the operator-managed Windows host 185.235.137.106 on AS59711 (HZ Hosting Ltd, Bulgaria-registered with Frankfurt presence) — an ASN previously seen in SideCopy infrastructure clusters.

Attribution rests on multiple converging signals: the LNK->mshta->remote-HTA-via-index.php pattern is a documented SideCopy signature since 2019; Run-key persistence with a process name typosquatting a legitimate Windows component matches prior SideCopy tradecraft; staging on legitimate government IP space and reuse of HZ Hosting echo known SideCopy clusters; and Seqrite confirmed in December 2024 that SideCopy formally adopted customized XenoRAT variants (after earlier AsyncRAT use). Naming consistency between the delivery path 'cloudiyaf' and the RAT mutex/startup string 'clouda' suggests a single operator managing both infrastructure tiers.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.001 Spearphishing Attachment
- T1218.005 Mshta
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1129 Shared Modules
- T1106 Native API
- T1204.002 Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1027.011 Fileless Storage
- T1218 System Binary Proxy Execution
- T1564.001 Hidden Files and Directories
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1070.004 File Deletion
- T1012 Query Registry
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1115 Clipboard Data
- T1123 Audio Capture
- T1125 Video Capture
- T1071.001 Web Protocols
- T1095 Non-Application Layer Protocol
- T1573.001 Symmetric Cryptography
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**XENOFISCAL XenoRAT Encrypted TCP C2 Beacon — C2 / Lateral Movement Phase** (`TL-2026-0625-SPL-003`)

Detects Operation XENOFISCAL XenoRAT 1.8.7 C2: a persistent encrypted TCP channel (custom AES with shared key and fixed IV via CryptoStream, RTL-compressed, SOCKS5-capable) to 185.235.137.106 on AS59711 (HZ Hosting), plus a heuristic for long-lived fixed-cadence beacons on non-standard ports. Covers the intentionally-omitted functional implant via C2 telemetry.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=network (sourcetype="stream:tcp" OR sourcetype="bro:conn:json" OR sourcetype="pan:traffic")
| where (dest_ip="185.235.137.106" OR cidrmatch("185.235.137.0/24",dest_ip)) OR (transport="tcp" AND dest_port>1024 AND NOT match(app,"(?i)http|tls|ssl|dns"))
| bin _time span=1m
| stats count as conns sum(bytes_out) as bytes_out sum(bytes_in) as bytes_in dc(_time) as active_minutes by src_ip, dest_ip, dest_port
| eval ratio=round(bytes_out/(bytes_in+1),2)
| where dest_ip="185.235.137.106" OR (active_minutes>=10 AND conns>=10 AND dest_port!=443 AND dest_port!=80)
| sort - conns
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == "185.235.137.106" or (RemoteIPType == "Public" and RemotePort !in (80,443,53))
| summarize conns=count(), firstSeen=min(Timestamp), lastSeen=max(Timestamp), ports=make_set(RemotePort), procs=make_set(InitiatingProcessFileName) by DeviceName, RemoteIP
| extend durationMin = datetime_diff('minute', lastSeen, firstSeen)
| where RemoteIP == "185.235.137.106" or (durationMin >= 10 and conns >= 10)
| sort by conns desc
```

### Sigma

```yaml
title: XENOFISCAL XenoRAT Encrypted TCP C2 Beacon (AES Fixed-IV)
id: 7c1f3e2a-9b40-4f51-8c2d-1a2b3c4d5e03
status: experimental
description: Detects Operation XENOFISCAL XenoRAT 1.8.7 C2 — long-lived encrypted TCP (custom AES shared key + fixed IV via CryptoStream, RTL-compressed, SOCKS5-capable) to operator C2 185.235.137.106 on AS59711 (HZ Hosting). T1573.001.
references:
    - https://www.seqrite.com/blog/operation-xenofiscal-sidecopy-deploying-persistent-xenorat-targeting-the-mof-afghanistan/
    - https://github.com/moom825/xeno-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/29
tags:
    - attack.command_and_control
    - attack.t1573.001
    - attack.t1095
    - attack.t1071.001
    - attack.t1090.002
logsource:
    category: firewall
detection:
    selection_ip:
        dst_ip:
            - '185.235.137.106'
    condition: selection_ip
falsepositives:
    - None for the hardcoded C2 IP. The beaconing heuristic variant may match legitimate long-lived TCP services — baseline destinations first.
level: critical
```

**Tuning notes:** Hardcoded C2 185.235.137.106 / AS59711 is high-fidelity — alert immediately. For variant hunting, tune beacon-cadence thresholds (active_minutes, conns) and exclude approved long-lived services.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- XENOFISCAL .NET Deserialization Reflective Load — Exploitation Phase (locked: unlock with TL Creds)
- XENOFISCAL RWX Shellcode Injection & AMSI Patch — Post-Exploitation Phase (locked: unlock with TL Creds)
- XENOFISCAL XenoRAT C2 Channel, AV Enumeration & clouda Mutex — C2 / Lateral Movement Phase (locked: unlock with TL Creds)
- XENOFISCAL HTA Staging & Custom Base64 Decode — Exploitation Phase (locked: unlock with TL Creds)
- XENOFISCAL Persistence & clouda Mutex — Post-Exploitation Phase (locked: unlock with TL Creds)
- XENOFISCAL AMSI Bypass, Reflective Load & Encrypted C2 — C2 / Defense Evasion Phase (locked: unlock with TL Creds)
- XENOFISCAL mshta Remote HTA Retrieval — Exploitation Phase (locked: unlock with TL Creds)
- XENOFISCAL Persistence — Run Key & Scheduled Task — Post-Exploitation Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `185.235.137[.]106`
- Domain: `abimj[.]edu[.]af`
- File hash: `194B912C242604D6F9A79369F22338C58A13CE0CC2ED280CE505075808BC2F14`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan](https://www.seqrite.com/blog/operation-xenofiscal-sidecopy-deploying-persistent-xenorat-targeting-the-mof-afghanistan/)
- [SideCopy APT Poses as Government Personnel to Distribute Open-Source XenoRAT Tool](https://cyberpress.org/sidecopy-apt-poses-as-government-personnel/)
- [SideCopy APT Hackers Impersonate Government Officials to Deploy Open-Source XenoRAT Tool](https://gbhackers.com/sidecopy-apt-hackers-impersonate-government-officials/)
- [XenoRAT — open-source .NET remote access tool (moom825)](https://github.com/moom825/xeno-rat)
- [MITRE ATT&CK — SideCopy (G1008)](https://attack.mitre.org/groups/G1008/)
- [MITRE ATT&CK — Transparent Tribe (G0134)](https://attack.mitre.org/groups/G0134/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0625