Operation XENOFISCAL - Mshta Network Call Followed by Payload Drop

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.