Pakistan-Linked Actor Deploys Xeno RAT Against Afghan Finance Ministry

A Pakistan-linked threat actor has been conducting cyber-espionage operations against the Afghan Finance Ministry using Xeno RAT, a publicly available remote access tool. Despite relying on standard TTPs and off-the-shelf tooling, the campaign has been effective against Afghanistan’s resource-constrained cybersecurity posture. The use of commodity malware by nation-state actors is a growing pattern — Xeno RAT has a public GitHub repository and is increasingly repurposed for targeted intrusions. Detection signatures for Xeno RAT are broadly available in major EDR and SIEM platforms, and organizations should verify coverage is active.