SideCopy Hackers Target Afghanistan Finance Ministry with XenoRAT Malware

Key Takeaways

• The Pakistan-linked threat group SideCopy is actively targeting Afghanistan’s Ministry of Finance.
• The attackers are deploying XenoRAT 1.8.7 malware via sophisticated spear-phishing campaigns.
• The campaign, dubbed “Operation XENOFISCAL,” aims to compromise provincial finance officials across all 34 Afghan Mustoufiats.
• Attackers leveraged compromised Afghan education infrastructure for initial payload delivery, employing living-off-the-land techniques and fileless execution for stealth.

SideCopy Hackers Deploy Persistent XenoRAT Malware Against Afghanistan’s Finance Ministry

The advanced persistent threat (APT) group known as SideCopy, believed to have ties to Pakistan, has launched a highly targeted cyberattack against Afghanistan’s Ministry of Finance. This sophisticated campaign, designated “Operation XENOFISCAL” by researchers, involves the deployment of XenoRAT malware and is focused on compromising provincial finance officials within all 34 of Afghanistan’s regional revenue and finance directorates, known as Mustoufiats.

The attack initiates with a meticulously crafted spear-phishing email. This email contains a ZIP archive designed to bypass initial defenses. Inside the archive, victims encounter a malicious shortcut file, cleverly disguised with a PDF icon and a filename written in Pashto, a primary language used by Afghan government personnel.

The lure document itself was designed to appear as an invitation list for a seminar on “psychological and intellectual warfare.” This specific theme suggests that the attackers possessed detailed intelligence regarding their targets’ professional environment and interests, indicating prior reconnaissance or access.

Security researchers at Seqrite identified and analyzed this ongoing campaign. In a report shared with Cyber Security News, Seqrite attributed the activity to the SideCopy APT cluster with medium-to-high confidence. SideCopy operates under the broader umbrella of Transparent Tribe, also known as APT36, a group with a well-documented history of cyber espionage targeting governmental entities across South Asia. Seqrite Labs has been monitoring this particular threat cluster for several years as part of its comprehensive global spear-phishing surveillance program.

Sophisticated Multi-Stage Infection Chain

Upon a victim opening the deceptive shortcut file, the malware leverages a legitimate Windows utility, mshta.exe, to silently connect to a compromised Afghan education domain (abimj.edu.af). This connection serves to fetch a remote payload. This technique, known as “Living-off-the-Land,” allows attackers to abuse built-in system tools, thereby evading detection by conventional security solutions. The malware proceeds to decode obfuscated JavaScript in memory before establishing persistence within the Windows Registry, masquerading its entry as a legitimate Microsoft Edge process.

The infection chain unfolds across five distinct stages, each engineered to seamlessly transfer control to the subsequent stage while minimizing detection risks. After the initial shortcut file triggers mshta.exe, it retrieves an HTML Application (HTA) payload from the compromised abimj.edu.af domain. This HTA payload contains obfuscated JavaScript which, once decoded in memory, drops a .NET-based loader DLL to continue the infection process.

Subsequently, this loader DLL downloads an encoded, GZIP-compressed blob from attacker-controlled URLs, unpacking it entirely in memory. The shellcode then employs reflective loading, a fileless approach where executable memory is allocated and code is injected without writing the main payload to disk. This method significantly increases the difficulty for traditional antivirus software to detect and mitigate the threat.

The final stage of the attack chain deploys XenoRAT version 1.8.7. XenoRAT is an open-source Remote Access Trojan readily available on GitHub. Once active, it establishes an encrypted command-and-control (C2) connection to a “bulletproof” server located in Frankfurt, Germany. This C2 infrastructure is intentionally segregated from the initial delivery domain, a strategic design choice to ensure long-term access and control, even if the initial delivery mechanisms are discovered and neutralized.

Persistence and Operational Infrastructure

Once XenoRAT is active, it functions as a potent surveillance tool. It connects to a hard-coded IP address using encrypted TCP traffic and ensures its persistence through two mechanisms: a Windows Scheduled Task named “XenoUpdateManager” and a Registry Run key. To prevent multiple instances from running simultaneously, the malware utilizes a mutex named “clouda.” Furthermore, it queries installed antivirus products on the compromised system before reporting this information back to its operators.

A critical detail uncovered by researchers is the decoy document dropped during the execution phase. This document was a genuine internal staff directory of the Afghan Ministry of Finance, containing sensitive information such as names of Finance Directors, Revenue Chiefs, and Secretaries from all 34 provinces, complete with their mobile numbers. This level of granular detail strongly suggests that SideCopy conducted extensive prior intelligence gathering, likely through earlier compromises of Afghan government networks.

The delivery domain, abimj.edu.af, resolved to IP addresses 103.132.98.224 and 103.132.98.226. Both of these IPs belong to a subnet administered by Afghanistan’s Ministry of Communication. By staging malicious payloads on local Afghan infrastructure, the attackers were able to blend their traffic with legitimate government communications, effectively bypassing network monitoring tools. The XenoRAT C2 server, located at 185.235.137.106, was hosted on AS59711, a Bulgarian-registered provider with data center presence in Frankfurt, Germany, which has previously been associated with SideCopy’s malicious activities.

Indicators of Compromise (IoCs):-

What You Should Do

• Monitor for Anomalous Executions: Actively monitor for unusual executions of legitimate Windows binaries such as mshta.exe, especially when initiated from unexpected processes or user contexts.
• Audit Registry Run Keys and Scheduled Tasks: Regularly audit the Windows Registry for suspicious “Run” keys, particularly those mimicking legitimate processes like “Edgre” (masquerading as Microsoft Edge). Similarly, review scheduled tasks for unfamiliar entries such as “XenoUpdateManager.”
• Implement Application Allow-Listing: Enforce application allow-listing policies to restrict the execution of unauthorized applications and scripts, limiting the effectiveness of living-off-the-land techniques.
• Restrict HTA Execution: Limit or restrict the execution of HTML Application (HTA) files from public or temporary directories to mitigate a common vector for initial payload delivery.
• Enhance Email Security: Implement robust email security solutions with advanced threat protection, sandboxing, and anti-phishing capabilities to detect and block spear-phishing attempts. Educate users on identifying and reporting suspicious emails.
• Network Traffic Monitoring: Monitor outbound network traffic for connections to unusual or unrecognized European hosting providers (e.g., IP address 185.235.137.106) and encrypted C2 communications.
• Utilize Threat Intelligence: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, endpoint detection and response (EDR) platforms, and other security tools for proactive detection.
• Endpoint Protection Updates: Ensure that endpoint protection platforms (EPP) and antivirus software are up-to-date. Seqrite has released specific detection signatures, including Link.Downloader.50744.GC and Script.Netloader.50745.GC, to help identify compromised systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.