SideCopy Resurfaces: Xeno RAT & LNK Deception in Afghan MOF Attacks

Saw the report on The Hacker News this morning about SideCopy pivoting back to target the Afghan Ministry of Finance. It's interesting to see them sticking to the old reliable ZIP + LNK delivery method, but this time they’re deploying Xeno RAT, an open-source C# remote access trojan.

For those who haven't dug into Xeno RAT yet, it's fairly feature-rich for an open-source project—offering keylogging, audio capture, and remote desktop capabilities. Since it's .NET-based, it often flags slightly differently in EDR telemetry than your standard C/C++ malware, depending on the obfuscation level.

The campaign relies heavily on social engineering, using Pashto-language filenames in the LNK files to increase the success rate of the spear-phishing hook. The LNK file typically executes a PowerShell or CMD command to retrieve the next stage.

If you're hunting for this in your environment, specifically look for ZIP archives containing LNK files. A quick way to scan user download directories for this vector is using this PowerShell snippet:

Get-ChildItem -Path "C:\Users\*\Downloads" -Filter *.zip -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $archive = [System.IO.Compression.ZipFile]::OpenRead($_.FullName)
        $lnkFiles = $archive.Entries | Where-Object { $_.Name -match '\.lnk$' }
        if ($lnkFiles) {
            Write-Host "Potential threat found in: $($_.FullName)"
            $lnkFiles | ForEach-Object { Write-Host "  - $($_.FullName)" }
        }
        $archive.Dispose()
    } catch {}
}

Since this is open-source, we can expect the signatures to change rapidly as other groups adopt Xeno RAT. I'm currently looking for behavioral anomalies, specifically cmd.exe or powershell.exe spawning directly from explorer.exe with archive-related arguments.

Has anyone else started seeing Xeno RAT in the wild outside of this specific geopolitical targeting? I'm curious if the C2 infrastructure has any overlaps with previous SideCopy campaigns.