XDSpy

XDSpy is malware referenced in the provided content as part of phishing-based intrusion activity. It is identified under the name XDSpy, with no additional aliases provided. The content associates XDSpy with the threat cluster Silent Werewolf, which has been active since at least 2011 and has targeted organizations in Russia, Belarus, Ukraine, Moldova, and Serbia. Silent Werewolf is described as using phishing lures to deliver malware such as XDSpy, XDigo, and DSDownloader. In March 2025 campaigns targeting Moldovan and Russian companies, the attacks were characterized by phishing emails carrying ZIP attachments with LNK files and nested ZIP archives; the broader delivery chain described for these campaigns involved DLL sideloading via DeviceMetadataWizard.exe and a C# loader named d3d9.dll, although the content specifically says these campaigns likely used XDigo as the payload rather than explicitly attributing that chain to XDSpy. The actor is reported to have targeted sectors including nuclear, aircraft, instrumentation, and mechanical engineering in Russia. No malware-family-specific capabilities, persistence mechanisms, command-and-control details, or indicators of compromise for XDSpy are directly provided in the content.