Summary: XDSpy, a cyberespionage group, has recently targeted victims in Russia and Moldova using a new malware variant, employing phishing tactics to deliver malicious code. The group, believed to be state-sponsored, has a history of targeting military and industrial sectors in Eastern Europe and the Balkans since 2011.
Threat Actor: XDSpy | XDSpy
Victim: Various organizations in Russia and Moldova | Various organizations in Russia and Moldova
Key Point :
- XDSpy sent phishing emails containing links to malicious executables to targets in Russia and Transnistria.
- The group utilized a new tool called XDSpy.DSDownloader to execute their attacks.
- Despite their long history, the country backing XDSpy remains unidentified.
- XDSpy has previously targeted military, finance, energy, research, and mining sectors in Russia.
- Researchers note that while XDSpy’s toolkit isn’t highly sophisticated, their operational security is commendable, allowing them to evade detection effectively.
A cyberespionage group known as XDSpy recently targeted victims in Russia and Moldova with a new malware variant, researchers have found.
In a campaign earlier this month, the suspected nation state-linked group sent phishing emails to targets in Russia, including a tech company that develops software for cash registers, as well as to an unidentified organization in Transnistria, the Russian-controlled breakaway region in Moldova.
The malicious emails, discovered by Russian cybersecurity firm F.A.C.C.T., contained a link to an archive with a legitimate executable file, which allowed attackers to run malicious code without raising suspicion.
During these attacks, the hackers used a previously unknown tool, which the researchers called XDSpy.DSDownloader. F.A.C.C.T. didn’t disclose whether the hackers managed to penetrate the victims’ systems and steal data.
XDSpy is believed to be a state-controlled threat actor, active since 2011, that primarily attacks countries in Eastern Europe and the Balkans. Despite the group’s long history, researchers have been unable to identify the country backing it.
Most of XDSpy’s targets are related to the military, finance, energy, research and mining industries in Russia, according to F.A.C.C.T.
Earlier in December, the group targeted a Russian metallurgical enterprise and a research institute involved in the development and production of guided missile weapons. In an attack last July, the hackers sent phishing letters with malicious PDF attachments to an unnamed but “well-known” research institute.
XDSpy doesn’t operate a particularly sophisticated toolkit, but “they have very decent operational security,” researchers at cybersecurity firm ESET told Recorded Future News in a previous interview.
“They are putting quite a lot of effort into the obfuscation of their implants in order to try to evade security solutions. As such, it is likely they have a decent percentage of success, even if we have been able to track their operations in the long run,” ESET said.
Recorded Future
Intelligence Cloud.
Source: https://therecord.media/russia-moldova-cyberespionage-campaign