Skip to content
skopnix
Adversaries · Dossier
← Adversaries

File · XDSpy · Unknown · misp-galaxy · refreshed 2026-10-06

XDSpy

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2020-0968

Analyst brief

misp-galaxy

Rare is the APT group that goes largely undetected for nine years, but XDSpy is just that; a previously undocumented espionage group that has been active since 2011. It has attracted very little public attention, with the exception of an advisory from the Belarusian CERT in February 2020. In the interim, the group has compromised many government agencies and private companies in Eastern Europe and the Balkans.

Observed targets (as stated by the sources)

0 countries · 1 sectors

assessed originnot stated by sourcesobserved targets · 0

sectors · 1

  • Government, Administration

as stated by MISP galaxy / ransomware.live — not inferred

CVEs XDSpy is cited as exploiting

none on KEV
  1. CVE-2020-09682026-10-17
    1. “XDSpy has exploited a vulnerability (CVE-2020-0968) in Internet Explorer (triggered by a malicious RTF file).”

      cited as exploiting · source: welivesecurity.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

5 rules · Sigma · QRadar · Cortex

  1. Actor indicator sweep

    XDSpy file hash indicators

    XDSpy

    T1204.002conf 72SIGAQL

  2. Indicator

    Known-malicious file hash observed

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  3. Indicator

    Malicious Hashes

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  4. Indicator

    Execution of known malicious file 99729ac323fc8a81…

    XDSpy

    T1204.002conf 72SIG

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

3 sources
  1. 1.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011
  2. 2.vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf
  3. 3.github.com/eset/malware-ioc/tree/master/xdspy

Track XDSpy on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.