XE Group

XE Group is a cybercriminal threat actor. In the cited CISA/FBI/MS-ISAC advisory, it is identified as Threat Actor 2 (TA2) and was observed conducting reconnaissance and scanning associated with successful exploitation of Progress Telerik UI for ASP.NET AJAX vulnerabilities on U.S. federal civilian executive branch IIS servers, specifically exploitation correlated to CVE-2019-18935. CISA assessed that XE Group exploited CVE-2019-18935 to upload at least three unique DLL payloads into C:\Windows\Temp\ and execute them via the IIS worker process w3wp.exe. Its malware dropped and decoded reverse shell utilities including XEReverseShell.exe and Multi-OS_ReverseShell.exe, used certutil.exe to write files such as xesvrs.exe, and had the capability to decode a base64-encoded ASPX webshell named small.aspx from small.txt, although no webshell was observed to be dropped on the target system because of restrictive service account permissions. Domains associated with the actor in the advisory included xework[.]com, xegroups[.]com, and hivnd[.]com, which resolved to 184.168.104[.]171 and 144.96.103[.]245 at the time of analysis. Separate supporting content also states that XE Group exploited zero-day vulnerabilities in VeraCore, a supply chain management software product, for information theft. Known alias in the provided content: xe_group.