SideCopy, a Pakistan-linked APT under the Transparent Tribe umbrella, conducted a spear phishing campaign targeting Afghanistan's Ministry of Finance and provincial revenue directorates. The attack initiates with a Pashto-language LNK file disguised as a staff directory document, which runs mshta.exe to fetch remote HTA payloads hosted on compromised Afghan educational domains. The infection chain involves obfuscated JavaScript and registry-based persistence that mimics Microsoft Edge to evade detection. The payload deployed is XenoRAT version 1.8.7, which beacons to bulletproof hosting infrastructure located in Bulgaria. The campaign demonstrates precise targeting using decoy documents in local languages containing contact details of provincial finance officials. Infrastructure overlaps with prior SideCopy activity and includes deliberate staging within Afghan government IP ranges. There is no indication of a patch or remediation from the vendor, and no known exploits in the wild have been reported.

The campaign enables persistent remote access to targeted systems within Afghanistan's Ministry of Finance and provincial revenue directorates via XenoRAT malware. This could allow the threat actor to conduct espionage, data exfiltration, or further network compromise. The use of localized spear phishing lures and infrastructure within Afghan government IP space increases the likelihood of successful infection. The malware's persistence mechanism and use of bulletproof hosting complicate detection and removal. However, no direct evidence of exploitation beyond infection vectors is provided, and no known exploits or vulnerabilities are indicated.

No official patch or remediation is available for this threat as it involves targeted spear phishing and malware deployment rather than a software vulnerability. Organizations should focus on user awareness training to recognize spear phishing attempts, especially those using localized language lures. Monitoring and blocking known indicators of compromise such as the listed IP addresses, domains, and file hashes can help detect and prevent infection. Incident response should include removal of registry persistence mechanisms and network containment. Since this is a targeted campaign, tailored defensive measures aligned with the threat intelligence are recommended. Patch status is not applicable; check vendor advisories or threat intelligence updates for any new mitigation guidance.