Tag: hta payload

1 Attack Reports | 0 Vulnerabilities

Attack reports

Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan

SideCopy APT, a Pakistan-linked threat group under the Transparent Tribe umbrella, executed a targeted spear phishing campaign against Afghanistan's Ministry of Finance and provincial revenue directorates. The attack begins with a Pashto-language LNK file disguised as a staff directory document, wh…
transparent tribe
xenorat
apt36
spear phishing
multi-stage loader
2026-05-29
afghanistan ministry of finance
hta payload
pashto lure
provincial targeting
sidecopy
Published: May 29, 2026
Downloadable IOCs: 11
Click here to see more Attack Reports