Operation XENOFISCAL exposes financial espionage and persistent surveillance against Afghan administration

Security researchers have shown a campaign for the Afghan State financial machinery that combines social engineering techniques located with remote access tools that are easily available. Under the operational name Operation XENOFISCAL, the attackers - linked to the group known as SideCopy, associated with the wider Transparent Tribe- they used a ZIP file with a direct access (LNK) named in Pashto to commit officials and provincial hacienda addresses. The deliberate use of the pashto as a decoy is not anecdotal: it is proof that the opponent has knowledge of the objective environment and seeks to maximize the likelihood of the file being opened.

The infection chain takes advantage of Windows's native utilities to reduce the malicious signature: the LNK invokes mshta.exe to recover a HTA file hosted in a committed Afghan educational domain, leading to the execution in memory of JavaScript code. The scenario then includes persistence by Registry keys that simulate legitimate components (in this case, Microsoft Edge) and loading a loader in DLL that leaves on your computer version 1.8.7 of Xeno RAT next to a decoy document. To understand the mshta vector I recommend the official Microsoft documentation: https: / / learn.microsoft.com / en-us / windows-server / administration / windows-commands / mshta.

Xeno RAT is a tool capable of converting a committed host into a complete espionage and exfiltration platform: TCP communication with a control server, dynamic loading of DLL modules, programmed task creation, information collection on antivirus solutions, SokS5 tuning, file operations, key registration, screenshots, clipboard monitoring, access to webcam and microphone and the ability to remove your own persistence. Together, these functionalities allow both the silent extraction of financial data and the continued monitoring of administrative processes.

This incident is part of a broader campaign against the objectives of the subcontinent. On another front, operations aimed at Indian military infrastructure were described through manipulated .desktop Linux files, lures related to battleship vehicle contracts and a go-nicknamed implementation Deskrat. The recurrence of techniques and tools by the same group underlines a sustained strategy of intrusion and collection in the region. For context about the actor and his tactics, see the group profile at the MITRE ATT & CK base: https: / / attack.mitre.org / groups / G0066 /.

The implications are multiple. In the short term, the exfiltration of accounting and payroll data may facilitate fraud, economic sanctions or administrative manipulation. In the medium and long term, the persistence and monitoring capabilities open the door to covert operations that compromise the decision-making and fiscal security of entire provinces. From an operational point of view, the use of open source or widely available tools reduces the cost for the opponent and complicates detection when mixed with legitimate system processes.

For organizations and IT officials in government and financial environments, the immediate priority should be to contain and detect such intrusions. It is critical to restrict the implementation of mshta.exe and other interpreters from unreliable locations through application control policies (AppLocker or WDAC), tighten shortcut and HTA file execution rules and block automatic resource download from suspicious domains. The implementation of EDR solutions with the ability to monitor in memory and detect abnormal behavior substantially increases the likelihood of identifying an early infection.

Beyond technical hardening, human hygiene is crucial: training staff to identify lures in their native language, distrust of unexpected compressed files and verify through independent channels any communication involving documents or links related to financial procedures. In the event of suspicion, the affected machine should be isolated, the evidence (memory, records, process dumping) should be preserved for forensic analysis and the credentials and keys that may have been compromised should be rotated.

Finally, organizations should integrate specific detections into their log and telemetry: searches for unusual mshta executions, creating unprecedented programmed tasks, modifications to Run / RunOnce keys that mimic browsers, DLL loads from temporary locations and persistent TCP connections to non-scheduled destinations, especially if they show SOCKS5 tunnel patterns. Coordination between agencies, exchange of commitment indicators with regional partners and notification to competent authorities are necessary steps to mitigate the scope of campaigns which, such as Operation XENOFISCAL the operational and financial stability of public administrations.