Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 2 actorsExploits 1 CVE

XDigo

XDigo is a Go-based espionage malware/backdoor attributed to the XDSpy threat actor and observed in attacks from at least March 2025. Reporting links it to cyber-espionage operations targeting governmental entities in Eastern Europe and Russia, with a confirmed victim in the Minsk region of Belarus; related artifacts also suggested interest in Russian retail, financial, insurance, and governmental postal organizations. The malware is described as a 64-bit portable executable and as a newer version of malware previously described by Kaspersky as UsrRunVGA.exe.

The observed infection chain used specially crafted Windows LNK files distributed inside ZIP archives such as dokazatelstva.zip and proyekt.zip. These LNKs abused Windows shortcut parsing/UI weaknesses tracked in reporting as ZDI-CAN-25373 and related parsing inconsistencies to conceal the true command line. Execution led to a multi-stage chain involving JScript.NET compilation via jsc.exe, extraction of nested archives, launch of a legitimate signed Microsoft binary (DeviceMetadataWizard.exe), and DLL sideloading of a malicious d3d9.dll downloader dubbed ETDownloader. ETDownloader opened a decoy PDF, attempted to retrieve a stage-2 payload from hardcoded download-themed infrastructure, saved it under %AppData%\Roaming\2A5S2FQJSU9B, and established persistence by writing startapp.bat into the user Startup folder to launch the payload with a /startup argument at logon. This persistence supported deployment of the XDigo implant for ongoing data exfiltration.

XDigo performs host reconnaissance and data theft. Reported capabilities include collecting host and user information, directory listings, clipboard contents, screenshots, and files of interest, especially document/archive formats such as .doc, .pdf, .xls, .ppt, .zip, .rar, .7z, .odt, .ods, and .rtf. It can also execute commands or binaries retrieved from its command-and-control server. Collected data is staged into AES-256-GCM-encrypted ZIP archives prior to exfiltration.

For command and control, XDigo communicates over HTTPS and has been observed using URLs such as hxxps://quan-miami[.]com/wevjhnyh/, with a z query parameter derived from the hard drive serial number. Tasking is protected with RSA-OAEP-encrypted commands and RSA-PSS signatures, and samples embed RSA keys for decryption and signature verification. Multiple XDigo-related C2 domains were reported across versions and timeframes, including melodicprogress[.]com, pechalnoyebudushcheye[.]com, quan-miami[.]com, and sogrevayushchiynapitok[.]com. A reported XDigo sample was vwjqrvdy.exe (Go 1.20), SHA-256 0d983f5fb403b500ec48f13a951548d5a10572fde207cf3f976b9daefb660f7e. The associated ETDownloader sideloaded DLL d3d9.dll was reported with SHA-256 792c5a2628ec1be86e38b0a73a44c1a9247572453555e7996bb9d0a58e37b62b, and the legitimate sideloading host DeviceMetadataWizard.exe with SHA-256 1793dae4d05cc7be9575f14ae7a73ffe3b8279a811c0db40f56f0e2c1ee8dd61.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES
CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityExploited in the wild

"...opening a bogus attachment that's designed to exploit ZDI-CAN-25373, a vulnerability that has been put to use by multiple threat actors... It's officially tracked as CVE-2025-9491 (CVSS score: 7.0)"

via the hacker newsthehackernews.com
THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
XDSpy

This ensured automatic execution upon user login, maintaining the DLL sideloading chain and deploying the XDigo implant for persistent data exfiltration operations.

via picus security blogpicussecurity.com
Silent Werewolf

Cybersecurity researchers have uncovered a Go-based malware called XDigo that has been used in attacks targeting Eastern European governmental entities in March 2025.

via the hacker newsthehackernews.com
MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique
T1566.001Spearphishing AttachmentEvidence1

“A third party publication … indicated some of those ZIP archives at least were distributed via spearphishing emails containing links to the archives.”

Execution

1 technique
T1204.002Malicious FileEvidence1

"...leveraged a collection of Windows shortcut (LNK) files as part of a multi-stage procedure..."; "...chain of shortcut files..."

Persistence

2 techniques
T1547.001Registry Run Keys / Startup FolderEvidence1

The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.

T1547.009Shortcut ModificationEvidence1

T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.

Privilege Escalation

2 techniques
T1547.001Registry Run Keys / Startup FolderEvidence1

The primary persistence mechanism targets the Windows Startup folder, located at: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ %PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ The Windows Explorer shell automatically enumerates and executes all items within these directories during the user logon process.

T1547.009Shortcut ModificationEvidence1

T1547.009 Shortcut Modification is a technique in the MITRE ATT&CK framework under the Persistence tactic. It involves the modification of shortcuts (typically .lnk files) in Windows to achieve persistence by ensuring that malicious programs or scripts are executed whenever the user interacts with the shortcut.

Stealth

1 technique
T1497Virtualization/Sandbox EvasionEvidence1

“runs several ‘anti-analysis’ checks… stops if hardware characteristics … hostname or current user name … match predefined values… halts if any of 18 files exist”

Credential Access

1 technique
T1555Credentials from Password StoresEvidence1

“sksatgmf.exe has additional information stealing capabilities allowing it to retrieve credentials that may have been saved … from web browsers and email clients”

Discovery

2 techniques
T1083File and Directory DiscoveryEvidence1

“scanning the current user’s home directory for files with … extensions … [and] scanning volumes other than C:”

T1497Virtualization/Sandbox EvasionEvidence1

“runs several ‘anti-analysis’ checks… stops if hardware characteristics … hostname or current user name … match predefined values… halts if any of 18 files exist”

Collection

4 techniques
T1005Data from Local SystemEvidence1

“collects information about the compromised host … getting the current user name and listing the directories located in C:\Program Files*\*”

T1113Screen CaptureEvidence1

“capturing a screenshot”

T1115Clipboard DataEvidence1

“retrieving the content of the clipboard”

T1560.001Archive via UtilityEvidence1

“it creates a ZIP archive (using the “Store” method …) … finally, it encrypts the ZIP archive”

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence1

“communicates with its C2 server by sending GET and POST requests through HTTPS … hxxps://quan-miami[.]com/wevjhnyh/”

T1105Ingress Tool TransferEvidence1

“downloads the next stage payload from a hardcoded URL … the downloaded payload is … saved under … ytoqovbxx.exe , [and] executed”

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
3 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app3 months ago
domain●●●●●●●●●●●●View more in app8 months ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.