Pakistan Spies on Afghan Finance Ministry With Xeno RAT

A Pakistani-linked APT known as SideCopy targeted Afghanistan's Ministry of Finance and provincial employees with spear-phishing lures localized in Pashto. The attackers used ZIP archives containing LNK files that invoked mshta to fetch and decode HTA payloads in memory, installed loaders, established registry persistence disguised as Microsoft Edge, and deployed a customized Xeno RAT with hardcoded C2 infrastructure hosted through a bulletproof service and a compromised Afghan government domain to blend malicious traffic with legitimate state traffic.