Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan

SideCopy, a Pakistan-linked APT, launched a highly targeted spear phishing campaign against Afghanistan’s Ministry of Finance using a sophisticated, multi-stage infection chain that leveraged local government infrastructure to stealthily deploy persistent XenoRAT malware for long-term surveillance and access.