ESET discovers a rare APT that stayed undetected for nine years

guest · Oct 2, 2020

ESET discovers a rare APT that stayed undetected for nine years
Active since 2011 but only discovered this year [...] XDSpy hacker group
October 2, 2020
https://www.zdnet.com/article/eset-discovers-a-rare-apt-that-stayed-undetected-for-nine-years/

Slovak cyber-security firm ESET has discovered a new state-sponsored hacking group (also known as an APT). Named XDSpy, the group is a rarity in the cyber-security landscape as it managed to remain undetected for nearly nine years before its hacking spree was discovered earlier this year.

The group's operations have been detailed for the first time today by ESET researchers in a talk at the Virus Bulletin 2020 security conference.
ESET says the group's primary focus has been reconnaissance and document theft. Its targets have been government agencies and private companies in Eastern Europe and the Balkans.
Click to expand...

The malware, described to ZDNet by Faou as "not state-of-the-art" was, however, more than enough to infect victims and help the group gather sensitive data from infected targets.

ESET described XDDown as a "downloader" used to infect a victim and then download secondary modules that would perform various specialized tasks.
This prevented security tools from detecting XDDown as malicious itself, but also allowed the malware to posses some very advanced features.
Click to expand...

There are certain details in the group's malware to support its classification as an APT. This includes the fact that many of the plugins didn't contain a persistence mechanism [...]
Furthermore, ESET said it also discovered that some XDDown plugins also came with time-based killswitches that removed them after a certain date.
Click to expand...

XDSpy: stealing government secrets since 2011

It is very uncommon to find a cyber espionage operation without any public reporting after almost 10 years of activity.
XDSpy tools are quite basic, although efficient.

This paper presents the full chain of XDSpy’s operations, from the phishing email to the spyware. We will also compare XDSpy’s TTPs with the ones of known APT groups operating in the same region in order to show that this campaign seems quite unique.
Click to expand...

Log in or Sign up

ESET discovers a rare APT that stayed undetected for nine years

guest Guest

Log in or Sign up

ESET discovers a rare APT that stayed undetected for nine years

guest Guest

Useful Searches