XDSpy
XDSpy is a cyber-espionage threat actor active since at least 2011. Reporting describes it as a previously undocumented espionage group that has targeted government agencies, militaries, ministries of foreign affairs, and private companies in Eastern Europe and the Balkans, with victims identified in Belarus, Moldova, Russia, Serbia, and Ukraine. More recent reporting attributes an ongoing campaign from March 2025 to XDSpy targeting Eastern European and Russian governmental entities, including at least one confirmed victim in the Minsk region of Belarus. Observed intrusion methods include spearphishing emails delivering malicious attachments or links to ZIP/RAR archives, including LNK-based infection chains. In 2020, XDSpy also used the patched Internet Explorer vulnerability CVE-2020-0968 via malicious RTF and HTML files. In 2025, XDSpy was reported abusing Windows LNK weaknesses including ZDI-CAN-25373 / CVE-2025-9491 and additional LNK parsing inconsistencies to conceal command execution. Reported delivery chains used crafted LNK files in ZIP archives such as dokazatelstva.zip and proyekt.zip, nested archives, decoy PDFs, and DLL sideloading via the legitimate signed Microsoft binary DeviceMetadataWizard.exe. Its malware ecosystem includes XDDown, a downloader that persists via the Windows Registry Run key and retrieves plugins over HTTP; plugins named XDRecon, XDList, XDMonitor, XDUpload, XDLoc, and XDPass support reconnaissance, file discovery, removable media monitoring, file exfiltration, Wi-Fi-based geolocation, and password theft. Recent activity is also linked to ETDownloader, a .NET downloader that establishes persistence via a Startup-folder batch file, and to XDigo, a Go-based espionage implant attributed to XDSpy. XDigo has been described as collecting host and user information, directory listings, clipboard contents, screenshots, and documents, staging data into AES-256-GCM-encrypted ZIP archives, and communicating with command-and-control over HTTPS using encrypted and signed tasking. Researchers cited in the content state they could not confidently link XDSpy to any publicly known APT group based on malware code or infrastructure overlap. The actor is consistently characterized in the content as an espionage-focused group with a long-running emphasis on government targets in Eastern Europe and Belarus in particular. Known aliases and related malware/subcomponents mentioned in the content include XDDown, XDRecon, XDList, XDMonitor, XDUpload, XDLoc, XDPass, ETDownloader, and XDigo.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Military
Where they target
Geographies tied to known operations.
- 🇧🇾 Belarus
- 🇲🇩 Moldova
- 🇷🇺 Russia
- 🇷🇸 Serbia
- 🇺🇦 Ukraine
Tradecraft
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
"...opening a bogus attachment that's designed to exploit ZDI-CAN-25373, a vulnerability that has been put to use by multiple threat actors... It's officially tracked as CVE-2025-9491 (CVSS score: 7.0)"
At the end of June 2020, the operators stepped up their game by using a vulnerability in Internet Explorer, CVE-2020-0968, which had been patched in April 2020. Instead of delivering an archive with a LNK file, the C&C server was delivering an RTF file that, once opened, downloaded an HTML file exploiting the aforementioned vulnerability.
Observables
47 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses malicious .LNK files in ZIP archives to achieve execution and persistence, leveraging LNK parsing/UI confusion, extracting payloads, using DLL sideloading via DeviceMetadataWizard.exe, and establishing Startup-folder persistence for data exfiltration.
XDSpy is known for cyber espionage campaigns targeting Eastern European government organizations, exploiting Windows shortcut vulnerabilities for malware delivery.
XDSpy is known for cyber espionage campaigns targeting Eastern European governmental entities, distributing the XDigo malware via exploitation of CVE-2025-9491.
Cyber-espionage cluster abusing the same Windows shortcut vulnerability to distribute the Go-based malware XDigo against Eastern European government targets.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.