Cybersecurity researchers have uncovered a Go-based malware known as XDigo that has been utilized in assaults concentrating on Jap European governmental entities in March 2025.
The assault chains are stated to have leveraged a set of Home windows shortcut (LNK) recordsdata as a part of a multi-stage process to deploy the malware, French cybersecurity firm HarfangLab stated.
XDSpy is the identify assigned to a cyber espionage that is identified to focus on authorities companies in Jap Europe and the Balkans since 2011. It was first documented by the Belarusian CERT in early 2020.
Lately, firms in Russia and Moldova have been focused by numerous campaigns to ship malware households like UTask, XDDown, and DSDownloader that may obtain extra payloads and steal delicate info from compromised hosts.
HarfangLab stated it noticed the risk actor leveraging a distant code execution flaw in Microsoft Home windows that is triggered when processing specifically crafted LNK recordsdata. The vulnerability (ZDI-CAN-25373) was publicly disclosed by Pattern Micro earlier this March.
“Crafted information in an LNK file could cause hazardous content material within the file to be invisible to a person who inspects the file through the Home windows-provided person interface,” Pattern Micro’s Zero Day Initiative (ZDI) stated on the time. “An attacker can leverage this vulnerability to execute code within the context of the present person.”
Additional evaluation of the LNK file artifacts that exploit ZDI-CAN-25373 has uncovered a smaller subset comprising 9 samples, which benefit from an LNK parsing confusion flaw stemming because of Microsoft not implementing its personal MS-SHLLINK specification (model 8.0).
In keeping with the spec, the utmost theoretical restrict for the size of a string inside LNK recordsdata is the best integer worth that may be encoded inside two bytes (i.e., 65,535 characters). Nonetheless, the precise Home windows 11 implementation limits the whole saved textual content content material to 259 characters except command-line arguments.
“This results in complicated conditions, the place some LNK recordsdata are parsed otherwise per specification and in Home windows, and even that some LNK recordsdata which ought to be invalid per specification are literally legitimate to Microsoft Home windows,” HarfangLab stated.
“Due to this deviation from the specification, one can particularly craft an LNK file which seemingly executes a sure command line and even be invalid in keeping with third celebration parsers implementing the specification, whereas executing one other command line in Home windows.”
A consequence of mixing the whitespace padding problem with the LNK parsing confusion is that it may be leveraged by attackers to cover the command that is being executed on each Home windows UI and third-party parsers.
The 9 LNK recordsdata are stated to have been distributed inside ZIP archives, with every of the latter containing a second ZIP archive that features a decoy PDF file, a reputable however renamed executable, and a rogue DLL that is sideloaded through the binary.
It is value noting this assault chain was documented by BI.ZONE late final month as carried out by a risk actor it tracks as Silent Werewolf to contaminate Moldovan and Russian firms with malware.
The DLL is a first-stage downloader dubbed ETDownloader that, in flip, is probably going meant to deploy an information assortment implant known as XDigo based mostly on infrastructure, victimology, timing, ways, and tooling overlaps. XDigo is assessed to be a more recent model of malware (“UsrRunVGA.exe”) that was detailed by Kaspersky in October 2023.
XDigo is a stealer that may harvest recordsdata, extract clipboard content material, and seize screenshots. It additionally helps instructions to execute a command or binary retrieved from a distant server over HTTP GET requests. Knowledge exfiltration happens through HTTP POST requests.
A minimum of one confirmed goal has been recognized within the Minsk area, with different artifacts suggesting the concentrating on of Russian retail teams, monetary establishments, massive insurance coverage firms, and governmental postal providers.
“This concentrating on profile aligns with XDSpy’s historic pursuit of presidency entities in Jap Europe and Belarus specifically,” HarfangLab stated.
“XDSpy’s focus can be demonstrated by its custom-made evasion capabilities, as their malware was reported as the primary malware making an attempt to evade detection from PT Safety’s Sandbox answer, a Russian cybersecurity firm offering service to public and monetary organizations within the Russian Federation.”
