This report investigates a 2025 cyber-espionage campaign by the XDSpy threat actor targeting Eastern European and Russian government entities using the XDigo malware and exploiting a Microsoft Windows LNK vulnerability (ZDI-CAN-25373). It provides detailed technical analysis of the malware, infection chains, infrastructure, and attribution tying the activity to XDSpy. #XDSpy #XDigo #ZDI-CAN-25373 #ETDownloader
Keypoints
- XDSpy has been conducting covert cyber-espionage since at least 2011, focusing mainly on Eastern European government targets with minimal prior Western reporting.
- The campaign abuses a Windows LNK file parsing vulnerability (ZDI-CAN-25373) combined with command line argument obfuscation to hide malicious payload execution.
- Malicious ZIP archives containing crafted LNK files distribute a multi-stage infection chain starting with a legitimate Microsoft executable sideloading a malicious DLL named ETDownloader.
- ETDownloader, a .NET stage 1 downloader, establishes persistence, opens decoy documents targeting Russian-speaking users, and fetches a second-stage Go implant called XDigo.
- XDigo implants perform anti-analysis checks, extensive file and data collection, and communicate securely with C2 servers, exhibiting continuous evolution over multiple sample versions.
- Infrastructure analysis reveals a large set of Russian-transliterated domain names used for distribution and command servers, linked across multiple campaigns attributed to XDSpy.
- Confirmed targets include Belarusian government entities involved in economic and regional development, consistent with XDSpy’s historical targeting profile.
MITRE Techniques
- [T1204] User Execution – The infection chain begins with the user opening malicious ZIP archives and LNK files that trigger payload execution. (‘user unzipping the archive and opening the embedded LNK file’)
- [T1547] Boot or Logon Autostart Execution – ETDownloader establishes persistence by creating a startup batch file in the user’s Start Menu Startup folder. (‘creates persistence by writing a startapp.bat Batch file… containing Start “” “%AppData%2A5S2FQJSU9BYEZYZO107H.exe” /startup’)
- [T1041] Exfiltration Over C2 Channel – Collected data and files are encrypted and exfiltrated to the C2 server using HTTPS POST multipart forms. (‘Files are being exfiltrated as multipart forms via HTTP POST requests…’)
- [T1059] Command and Scripting Interpreter – The LNK triggers execution of a Windows shell command and dynamically compiled JavaScript .NET code to unpack and run the payload. (‘compiles the… JavaScript .NET code snippet and runs… to extract and execute payload’)
- [T1036] Masquerading – The use of legitimate Microsoft signed executables (DeviceMetadataWizard.exe) to sideload malicious DLLs to evade detection. (‘stage 1 DLL sideloaded by legitimate signed Microsoft executable DeviceMetadataWizard.exe’)
- [T1083] File and Directory Discovery – XDigo implants scan user directories and other volumes for files with specific extensions. (‘scanning the current user’s home directory for files with one of 13 hardcoded extensions’)
- [T1064] Scripting – ETDownloader uses dynamically compiled .NET scripts for unpacking and execution of next stages. (‘compiles… using legitimate system compiler jsc.exe… runs the previously created unzip.exe’)
Indicators of Compromise
- [File Hashes] XDSpy ZIP archives and LNK files – 4f1d5081adf8ceed3c3daaaa3804e5a4ac2e964ec90590e716bc8b34953083e8 (dokazatelstva.zip), 65209053f042e428b64f79ea8f570528beaa537038aa3aa50a0db6846ba8d2ec (проект_00252053.lnk), and 7 more hashes.
- [File Hashes] ETDownloader DLL samples – 792c5a2628ec1be86e38b0a73a44c1a9247572453555e7996bb9d0a58e37b62b (d3d9.dll), 95060ba948948eea9bfc801731960b97d3efceb300622630afcbccfe12c21ccd, among others.
- [File Hashes] XDigo Go implant samples – 0d983f5fb403b500ec48f13a951548d5a10572fde207cf3f976b9daefb660f7e (vwjqrvdy.exe), 49714e2a0eb4d16882654fd60304e6fa8bfcf9dbd9cd272df4e003f68c865341, and 2 more hashes.
- [Domains] Distribution and C2 infrastructure – pdf-bazaar[.]com, pdfdepozit[.]com, quan-miami[.]com, pechalnoyebudushcheye[.]com, sogrevayushchiynapitok[.]com, and 18+ related domains.
- [File Names] Malicious artifacts – доказательства0007093.lnk, проект00252053.lnk, d3d9.dll, test.cfg (decoy document), YEZYZO107H.exe (legitimate executable).
Read more: https://harfanglab.io/insidethelab/sadfuture-xdspy-latest-evolution/