Early in 2020, ESET researchers discovered a previously undisclosed cyber espionage operation targeting several governments in Eastern Europe, the Balkans and Russia. Unusually, our research shows that this campaign has been active since at least 2011 with next to no changes in TTPs. It is very uncommon to find a cyber espionage operation without any public reporting after almost 10 years of activity.

A February 2020 Belarussian CERT advisory disclosed a spear-phishing campaign targeting several Belarussian ministries and agencies. Our research links this to XDSpy. The goal of that operation appears to be collecting documents from government staff such as diplomats or military personnel. Among the targets we also found a few private companies and academic institutions, suggesting that this actor is also responsible for economic espionage operations.

XDSpy tools are quite basic, although efficient. The malware samples are slightly obfuscated using string obfuscation and dynamic Windows API library loading. Their main functions include the monitoring of removable drives, taking screenshots and exfiltrating documents. In addition, we found a custom module collecting nearby Wi-Fi access point identifiers, probably with the objective of locating the compromised machines. They also use NirSoft utilities in order to recover passwords from web browsers and email clients. In some specific cases, we were able to retrieve lists of the paths to the stolen files. This allowed us to better understand the objective of this campaign.

This paper presents the full chain of XDSpy’s operations, from the phishing email to the spyware. We will also compare XDSpy’s TTPs with the ones of known APT groups operating in the same region in order to show that this campaign seems quite unique. Finally, we will provide the readers more high-level information about the campaign by going through some of the documents and targets of interest to the group.