XDigo
XDigo is a Go-based espionage malware/backdoor attributed to the XDSpy threat actor and observed in attacks from at least March 2025. Reporting links it to cyber-espionage operations targeting governmental entities in Eastern Europe and Russia, with a confirmed victim in the Minsk region of Belarus; related artifacts also suggested interest in Russian retail, financial, insurance, and governmental postal organizations. The malware is described as a 64-bit portable executable and as a newer version of malware previously described by Kaspersky as UsrRunVGA.exe.
The observed infection chain used specially crafted Windows LNK files distributed inside ZIP archives such as dokazatelstva.zip and proyekt.zip. These LNKs abused Windows shortcut parsing/UI weaknesses tracked in reporting as ZDI-CAN-25373 and related parsing inconsistencies to conceal the true command line. Execution led to a multi-stage chain involving JScript.NET compilation via jsc.exe, extraction of nested archives, launch of a legitimate signed Microsoft binary (DeviceMetadataWizard.exe), and DLL sideloading of a malicious d3d9.dll downloader dubbed ETDownloader. ETDownloader opened a decoy PDF, attempted to retrieve a stage-2 payload from hardcoded download-themed infrastructure, saved it under %AppData%\Roaming\2A5S2FQJSU9B, and established persistence by writing startapp.bat into the user Startup folder to launch the payload with a /startup argument at logon. This persistence supported deployment of the XDigo implant for ongoing data exfiltration.
XDigo performs host reconnaissance and data theft. Reported capabilities include collecting host and user information, directory listings, clipboard contents, screenshots, and files of interest, especially document/archive formats such as .doc, .pdf, .xls, .ppt, .zip, .rar, .7z, .odt, .ods, and .rtf. It can also execute commands or binaries retrieved from its command-and-control server. Collected data is staged into AES-256-GCM-encrypted ZIP archives prior to exfiltration.
For command and control, XDigo communicates over HTTPS and has been observed using URLs such as hxxps://quan-miami[.]com/wevjhnyh/, with a z query parameter derived from the hard drive serial number. Tasking is protected with RSA-OAEP-encrypted commands and RSA-PSS signatures, and samples embed RSA keys for decryption and signature verification. Multiple XDigo-related C2 domains were reported across versions and timeframes, including melodicprogress[.]com, pechalnoyebudushcheye[.]com, quan-miami[.]com, and sogrevayushchiynapitok[.]com. A reported XDigo sample was vwjqrvdy.exe (Go 1.20), SHA-256 0d983f5fb403b500ec48f13a951548d5a10572fde207cf3f976b9daefb660f7e. The associated ETDownloader sideloaded DLL d3d9.dll was reported with SHA-256 792c5a2628ec1be86e38b0a73a44c1a9247572453555e7996bb9d0a58e37b62b, and the legitimate sideloading host DeviceMetadataWizard.exe with SHA-256 1793dae4d05cc7be9575f14ae7a73ffe3b8279a811c0db40f56f0e2c1ee8dd61.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"...opening a bogus attachment that's designed to exploit ZDI-CAN-25373, a vulnerability that has been put to use by multiple threat actors... It's officially tracked as CVE-2025-9491 (CVSS score: 7.0)"
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This ensured automatic execution upon user login, maintaining the DLL sideloading chain and deploying the XDigo implant for persistent data exfiltration operations.
Cybersecurity researchers have uncovered a Go-based malware called XDigo that has been used in attacks targeting Eastern European governmental entities in March 2025.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
2 techniques
Persistence
The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.
T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.
Privilege Escalation
2 techniques
Privilege Escalation
The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.
T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.
Stealth
1 technique
Stealth
Credential Access
1 technique
Credential Access
Discovery
2 techniques
Discovery
Collection
4 techniques
Collection
IOCs tracked for this family
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An implant deployed for persistent data exfiltration operations following the downloader and DLL sideloading chain.
Go-based malware deployed via a multi-stage chain leveraging Windows LNK files; used against Eastern European government targets.
XDigo is a Go-based malware used by the XDSpy threat actor for cyber espionage, providing backdoor access and data theft capabilities.
Go-based malware distributed by the XDSpy espionage cluster via exploitation of the Windows shortcut (LNK) vulnerability CVE-2025-9491 / ZDI-CAN-25373.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.