SideCopy

SideCopy is a Pakistan-linked threat actor, described in the content as likely aligned with or an element of the Pakistani government and operating under or alongside the broader Transparent Tribe / APT36 umbrella. Known aliases in the provided content include SideCopy and TAG_140. The group is associated with cyber espionage activity across South Asia and is specifically noted for targeting government, military, and diplomatic entities, as well as sectors such as railways and oil. Recent reporting in the content attributes with medium-to-high confidence a spear-phishing campaign dubbed Operation XENOFISCAL to SideCopy, targeting Afghanistan’s Ministry of Finance, provincial revenue and finance directorates, and other Pashto-speaking Afghan government officials. In the Afghanistan campaign, SideCopy used tailored spear-phishing emails carrying ZIP archives containing malicious LNK files disguised as PDFs and named in Pashto. Execution of the LNK launched mshta.exe to retrieve a remote HTA or PHP-hosted payload from a compromised Afghan domain, followed by obfuscated JavaScript and multi-stage in-memory loading that ultimately deployed a customized Xeno RAT / XenoRAT 1.8.7 payload. The campaign used decoy Afghan Ministry of Finance staff directories, indicating prior reconnaissance, and established persistence through Windows Registry Run keys while masquerading as Microsoft Edge; some reporting in the content also notes scheduled-task persistence. The group used compromised Afghan government or education infrastructure to host payloads and blend malicious traffic with legitimate state activity, while command-and-control infrastructure was hosted separately on European or Bulgaria-linked infrastructure. The content also notes SideCopy’s use of compromised domains to host malicious payloads, spear-phishing emails with malicious HTA attachments, malicious embedded archive files, and a legitimate DLL filename such as Duser.dll to disguise a remote access tool. Beyond delivery and persistence tradecraft, the content states that SideCopy has performed host discovery including identifying the IP address, OS version, and country location of compromised hosts. The group is also described as using multiple malware families, including Xeno RAT, Spark RAT, CurlBack RAT, and FalseCub in related reporting, and as continuously evolving tactics to evade detection. The content further references SideCopy as a subgroup of APT36 / Transparent Tribe and notes its involvement in broader Pakistan-aligned cyber activity directed at neighboring countries, including India and Afghanistan.