{
  "aliases": [
    "xdigo"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 93,
    "url_path": 1
  },
  "first_seen": {
    "domain": {
      "365downloading.com": "2020-10-05",
      "aoc-upravleniye.com": "2026-01-02",
      "best-downloader.com": "2022-10-08",
      "boborux.com": "2020-10-05",
      "bukhgalter-x5group.com": "2026-01-02",
      "bystryvelosiped.com": "2026-01-02",
      "cellporyad.com": "2026-01-02",
      "chistyyvozdukh.com": "2026-01-02",
      "chtcc.net": "2020-10-05",
      "cracratutu.com": "2020-10-05",
      "daftsync.com": "2020-10-05",
      "documentsklad.com": "2020-10-05",
      "doverennyye-fayly.com": "2026-01-02",
      "download-365.com": "2020-10-05",
      "download24center.com": "2022-10-08",
      "downloading24.com": "2026-01-02",
      "downloadsprimary.com": "2020-10-02",
      "dropsklad.com": "2020-10-05",
      "dversteklo.com": "2026-01-02",
      "dwd765m.com": "2026-01-02",
      "easy-download24.com": "2026-01-02",
      "easytosay.org": "2020-10-05",
      "fakturaaa.com": "2026-01-02",
      "faylbox365.com": "2026-01-02",
      "faylsklad.com": "2026-01-02",
      "ferrariframework.com": "2020-10-05",
      "file-bazar.com": "2026-01-02",
      "file-download.org": "2020-10-05",
      "file-magazin.com": "2026-01-02",
      "filedownload.email": "2020-10-02",
      "full-downloader.com": "2026-01-02",
      "getthatupdate.com": "2020-10-05",
      "global-downloader.com": "2022-10-08",
      "jerseygameengine.com": "2020-10-05",
      "just-downloads.com": "2023-03-27",
      "khitrayalisitsa.com": "2026-01-02",
      "khoroshayamych.com": "2026-01-02",
      "kletchatayarubashka.com": "2026-01-02",
      "krasnayastena.com": "2026-01-02",
      "laultrachunk.com": "2026-01-02",
      "magnitgroup.com": "2026-01-02",
      "maiwegwurst.com": "2020-10-05",
      "melodicprogress.com": "2026-01-02",
      "migration-info.com": "2020-10-05",
      "minisnowhair.com": "2020-10-05",
      "moy-fayl.com": "2026-01-02",
      "moy-pdf.com": "2026-01-02",
      "my1businessconnection.com": "2022-10-08",
      "nevynosimayapchela.com": "2026-01-02",
      "nniir.com": "2026-01-02",
      "nomatterwhat.info": "2020-10-05",
      "obmen-faylami.com": "2026-01-02",
      "officeupdtcentr.com": "2020-10-05",
      "otpravkafaylov.com": "2026-01-02",
      "pdf-bazaar.com": "2026-01-02",
      "pdf-reyestr.com": "2026-01-02",
      "pdf-sklad.com": "2026-01-02",
      "pdfdepozit.com": "2026-01-02",
      "pdfmagazin.com": "2026-01-02",
      "pdfsklad.com": "2026-01-02",
      "pechalnoyebudushcheye.com": "2026-01-02",
      "promenimath.com": "2026-01-02",
      "protej.org.nniir.com": "2026-01-02",
      "quan-miami.com": "2026-01-02",
      "reyestr-faylov.com": "2026-01-02",
      "ru-pochta365.com": "2026-01-02",
      "ru-sistema.com": "2026-01-02",
      "sbordokumentov.com": "2024-07-27",
      "seatwowave.com": "2020-10-05",
      "serayagrust.com": "2026-01-02",
      "seychaspozzhe.com": "2026-01-02",
      "skachivanie-failov.com": "2026-01-02",
      "skachivanie-failov24.com": "2026-01-02",
      "slomannyymonitor.com": "2026-01-02",
      "sogrevayushchiynapitok.com": "2026-01-02",
      "svobodnoepredlozheniye.com": "2026-01-02",
      "temnayamashina.com": "2026-01-02",
      "theslideshare.com": "2020-10-02",
      "trxpay.cc": "2026-01-02",
      "tvoi-fayly.com": "2026-01-02",
      "tvoy-disk.com": "2026-01-02",
      "utrenneyesolntse.com": "2026-01-02",
      "vash-disk.com": "2026-01-02",
      "vashazagruzka365.com": "2026-01-02",
      "vashi-fayly.com": "2024-10-26",
      "wildboarcontest.com": "2020-10-02",
      "zagruzka-pdf.com": "2026-01-02",
      "zagruzkadannykh.com": "2026-01-02",
      "zagruzkafayla.com": "2026-01-02",
      "zelenyysalat.com": "2026-01-02",
      "zetta-strakhovaniye.com": "2026-01-02",
      "zhestovyyliker.com": "2026-01-02",
      "zimniyeravlecheniya.com": "2026-01-02"
    },
    "url_path": {
      "/wevjhnyh/": "2026-01-02"
    }
  },
  "first_seen_precision": {
    "domain": {
      "aoc-upravleniye.com": "at-or-before",
      "bukhgalter-x5group.com": "at-or-before",
      "bystryvelosiped.com": "at-or-before",
      "cellporyad.com": "at-or-before",
      "chistyyvozdukh.com": "at-or-before",
      "doverennyye-fayly.com": "at-or-before",
      "downloading24.com": "at-or-before",
      "dversteklo.com": "at-or-before",
      "dwd765m.com": "at-or-before",
      "easy-download24.com": "at-or-before",
      "fakturaaa.com": "at-or-before",
      "faylbox365.com": "at-or-before",
      "faylsklad.com": "at-or-before",
      "file-bazar.com": "at-or-before",
      "file-magazin.com": "at-or-before",
      "full-downloader.com": "at-or-before",
      "khitrayalisitsa.com": "at-or-before",
      "khoroshayamych.com": "at-or-before",
      "kletchatayarubashka.com": "at-or-before",
      "krasnayastena.com": "at-or-before",
      "laultrachunk.com": "at-or-before",
      "magnitgroup.com": "at-or-before",
      "melodicprogress.com": "at-or-before",
      "moy-fayl.com": "at-or-before",
      "moy-pdf.com": "at-or-before",
      "nevynosimayapchela.com": "at-or-before",
      "nniir.com": "at-or-before",
      "obmen-faylami.com": "at-or-before",
      "otpravkafaylov.com": "at-or-before",
      "pdf-bazaar.com": "at-or-before",
      "pdf-reyestr.com": "at-or-before",
      "pdf-sklad.com": "at-or-before",
      "pdfdepozit.com": "at-or-before",
      "pdfmagazin.com": "at-or-before",
      "pdfsklad.com": "at-or-before",
      "pechalnoyebudushcheye.com": "at-or-before",
      "promenimath.com": "at-or-before",
      "protej.org.nniir.com": "at-or-before",
      "quan-miami.com": "at-or-before",
      "reyestr-faylov.com": "at-or-before",
      "ru-pochta365.com": "at-or-before",
      "ru-sistema.com": "at-or-before",
      "serayagrust.com": "at-or-before",
      "seychaspozzhe.com": "at-or-before",
      "skachivanie-failov.com": "at-or-before",
      "skachivanie-failov24.com": "at-or-before",
      "slomannyymonitor.com": "at-or-before",
      "sogrevayushchiynapitok.com": "at-or-before",
      "svobodnoepredlozheniye.com": "at-or-before",
      "temnayamashina.com": "at-or-before",
      "trxpay.cc": "at-or-before",
      "tvoi-fayly.com": "at-or-before",
      "tvoy-disk.com": "at-or-before",
      "utrenneyesolntse.com": "at-or-before",
      "vash-disk.com": "at-or-before",
      "vashazagruzka365.com": "at-or-before",
      "zagruzka-pdf.com": "at-or-before",
      "zagruzkadannykh.com": "at-or-before",
      "zagruzkafayla.com": "at-or-before",
      "zelenyysalat.com": "at-or-before",
      "zetta-strakhovaniye.com": "at-or-before",
      "zhestovyyliker.com": "at-or-before",
      "zimniyeravlecheniya.com": "at-or-before"
    },
    "url_path": {
      "/wevjhnyh/": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2020-10-02",
    "latest": "2026-01-02"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "365downloading.com",
      "aoc-upravleniye.com",
      "best-downloader.com",
      "boborux.com",
      "bukhgalter-x5group.com",
      "bystryvelosiped.com",
      "cellporyad.com",
      "chistyyvozdukh.com",
      "chtcc.net",
      "cracratutu.com",
      "daftsync.com",
      "documentsklad.com",
      "doverennyye-fayly.com",
      "download-365.com",
      "download24center.com",
      "downloading24.com",
      "downloadsprimary.com",
      "dropsklad.com",
      "dversteklo.com",
      "dwd765m.com",
      "easy-download24.com",
      "easytosay.org",
      "fakturaaa.com",
      "faylbox365.com",
      "faylsklad.com",
      "ferrariframework.com",
      "file-bazar.com",
      "file-download.org",
      "file-magazin.com",
      "filedownload.email",
      "full-downloader.com",
      "getthatupdate.com",
      "global-downloader.com",
      "jerseygameengine.com",
      "just-downloads.com",
      "khitrayalisitsa.com",
      "khoroshayamych.com",
      "kletchatayarubashka.com",
      "krasnayastena.com",
      "laultrachunk.com",
      "magnitgroup.com",
      "maiwegwurst.com",
      "melodicprogress.com",
      "migration-info.com",
      "minisnowhair.com",
      "moy-fayl.com",
      "moy-pdf.com",
      "my1businessconnection.com",
      "nevynosimayapchela.com",
      "nniir.com",
      "nomatterwhat.info",
      "obmen-faylami.com",
      "officeupdtcentr.com",
      "otpravkafaylov.com",
      "pdf-bazaar.com",
      "pdf-reyestr.com",
      "pdf-sklad.com",
      "pdfdepozit.com",
      "pdfmagazin.com",
      "pdfsklad.com",
      "pechalnoyebudushcheye.com",
      "promenimath.com",
      "protej.org.nniir.com",
      "quan-miami.com",
      "reyestr-faylov.com",
      "ru-pochta365.com",
      "ru-sistema.com",
      "sbordokumentov.com",
      "seatwowave.com",
      "serayagrust.com",
      "seychaspozzhe.com",
      "skachivanie-failov.com",
      "skachivanie-failov24.com",
      "slomannyymonitor.com",
      "sogrevayushchiynapitok.com",
      "svobodnoepredlozheniye.com",
      "temnayamashina.com",
      "theslideshare.com",
      "trxpay.cc",
      "tvoi-fayly.com",
      "tvoy-disk.com",
      "utrenneyesolntse.com",
      "vash-disk.com",
      "vashazagruzka365.com",
      "vashi-fayly.com",
      "wildboarcontest.com",
      "zagruzka-pdf.com",
      "zagruzkadannykh.com",
      "zagruzkafayla.com",
      "zelenyysalat.com",
      "zetta-strakhovaniye.com",
      "zhestovyyliker.com",
      "zimniyeravlecheniya.com"
    ],
    "url_path": [
      "/wevjhnyh/"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "XDSPY"
  ],
  "references": [
    "https://cert.by/?p=1458 (Russian)",
    "https://github.com/eset/malware-ioc/tree/master/xdspy/",
    "https://harfanglab.io/insidethelab/sadfuture-xdspy-latest-evolution/",
    "https://otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c",
    "https://twitter.com/t3ft3lb/status/1578448091476131841",
    "https://twitter.com/t3ft3lb/status/1640373954018770945",
    "https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf",
    "https://www.virustotal.com/gui/file/050018ecd9792776ef435c794695078cfe70ad9852f0eaab8527adba58143c73/detection",
    "https://www.virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c09553851ecc9ceefc436e16ebb7fca5f1a/detection",
    "https://www.virustotal.com/gui/file/59b907430dde62fc7a0d1c33c38081b7dcf43777815d1abcf07e0c77f76f5894/detection",
    "https://www.virustotal.com/gui/file/60f2a6de283d37aba090db3be84a2da761717f20d6cfed002d4d0ef3a139f626/detection",
    "https://www.virustotal.com/gui/file/6d975d2b3557bc3eebc8b24fdafca6244c9a0f485a0a6406c0fe12f41f6ae5d0/detection",
    "https://www.virustotal.com/gui/file/745d7ff35fa716b105e85d492deff029d0dc04270612a4973923a63978395d4e/detection",
    "https://www.virustotal.com/gui/file/796b057a6d2b6e8e7ef7b9a81b2203ebc361eb4c6b4d8e4b13640c1a681df0a3/detection",
    "https://www.virustotal.com/gui/file/a08029b0a01228a2a4904da723862dcd0e7b8de2b825bb6a70ec5148737cc5de/detection",
    "https://www.virustotal.com/gui/ip-address/216.252.233.7/relations",
    "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/",
    "https://www.zdnet.com/article/eset-discovers-a-rare-apt-that-stayed-undetected-for-nine-years/",
    "https://x.com/malwrhunterteam/status/1816855989859106913",
    "https://x.com/malwrhunterteam/status/1900654391742316938",
    "https://x.com/t3ft3lb/status/1817943106181861704"
  ],
  "related": [],
  "slug": "XDSPY",
  "timeline": [
    {
      "counts": {
        "domain": 60,
        "url_path": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "aoc-upravleniye.com",
          "bukhgalter-x5group.com",
          "bystryvelosiped.com",
          "cellporyad.com",
          "chistyyvozdukh.com",
          "doverennyye-fayly.com",
          "downloading24.com",
          "dversteklo.com",
          "dwd765m.com",
          "easy-download24.com",
          "faylbox365.com",
          "faylsklad.com",
          "file-magazin.com",
          "full-downloader.com",
          "khitrayalisitsa.com",
          "khoroshayamych.com",
          "kletchatayarubashka.com",
          "krasnayastena.com",
          "laultrachunk.com",
          "magnitgroup.com",
          "melodicprogress.com",
          "moy-fayl.com",
          "moy-pdf.com",
          "nevynosimayapchela.com",
          "nniir.com",
          "obmen-faylami.com",
          "otpravkafaylov.com",
          "pdf-bazaar.com",
          "pdf-reyestr.com",
          "pdf-sklad.com",
          "pdfdepozit.com",
          "pdfmagazin.com",
          "pdfsklad.com",
          "pechalnoyebudushcheye.com",
          "promenimath.com",
          "protej.org.nniir.com",
          "quan-miami.com",
          "reyestr-faylov.com",
          "ru-pochta365.com",
          "ru-sistema.com",
          "serayagrust.com",
          "seychaspozzhe.com",
          "skachivanie-failov.com",
          "skachivanie-failov24.com",
          "slomannyymonitor.com",
          "sogrevayushchiynapitok.com",
          "svobodnoepredlozheniye.com",
          "temnayamashina.com",
          "tvoi-fayly.com",
          "tvoy-disk.com",
          "utrenneyesolntse.com",
          "vash-disk.com",
          "vashazagruzka365.com",
          "zagruzka-pdf.com",
          "zagruzkadannykh.com",
          "zagruzkafayla.com",
          "zelenyysalat.com",
          "zetta-strakhovaniye.com",
          "zhestovyyliker.com",
          "zimniyeravlecheniya.com"
        ],
        "url_path": [
          "/wevjhnyh/"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://harfanglab.io/insidethelab/sadfuture-xdspy-latest-evolution/",
        "https://www.virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c09553851ecc9ceefc436e16ebb7fca5f1a/detection",
        "https://www.virustotal.com/gui/file/050018ecd9792776ef435c794695078cfe70ad9852f0eaab8527adba58143c73/detection"
      ],
      "total": 61
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "fakturaaa.com",
          "file-bazar.com",
          "trxpay.cc"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/malwrhunterteam/status/1900654391742316938",
        "https://www.virustotal.com/gui/ip-address/216.252.233.7/relations",
        "https://www.virustotal.com/gui/file/59b907430dde62fc7a0d1c33c38081b7dcf43777815d1abcf07e0c77f76f5894/detection",
        "https://www.virustotal.com/gui/file/745d7ff35fa716b105e85d492deff029d0dc04270612a4973923a63978395d4e/detection",
        "https://www.virustotal.com/gui/file/796b057a6d2b6e8e7ef7b9a81b2203ebc361eb4c6b4d8e4b13640c1a681df0a3/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-10-26",
      "indicators": {
        "domain": [
          "vashi-fayly.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://harfanglab.io/insidethelab/sadfuture-xdspy-latest-evolution/",
        "https://www.virustotal.com/gui/file/155b94be1c3dca48314f6f2ee0c89c09553851ecc9ceefc436e16ebb7fca5f1a/detection",
        "https://www.virustotal.com/gui/file/050018ecd9792776ef435c794695078cfe70ad9852f0eaab8527adba58143c73/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-07-27",
      "indicators": {
        "domain": [
          "sbordokumentov.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/malwrhunterteam/status/1816855989859106913",
        "https://x.com/t3ft3lb/status/1817943106181861704",
        "https://www.virustotal.com/gui/file/a08029b0a01228a2a4904da723862dcd0e7b8de2b825bb6a70ec5148737cc5de/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-03-27",
      "indicators": {
        "domain": [
          "just-downloads.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1640373954018770945",
        "https://www.virustotal.com/gui/file/60f2a6de283d37aba090db3be84a2da761717f20d6cfed002d4d0ef3a139f626/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-10-08",
      "indicators": {
        "domain": [
          "best-downloader.com",
          "download24center.com",
          "global-downloader.com",
          "my1businessconnection.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/t3ft3lb/status/1578448091476131841",
        "https://www.virustotal.com/gui/file/6d975d2b3557bc3eebc8b24fdafca6244c9a0f485a0a6406c0fe12f41f6ae5d0/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 19
      },
      "first_seen": "2020-10-05",
      "indicators": {
        "domain": [
          "365downloading.com",
          "boborux.com",
          "chtcc.net",
          "cracratutu.com",
          "daftsync.com",
          "documentsklad.com",
          "download-365.com",
          "dropsklad.com",
          "easytosay.org",
          "ferrariframework.com",
          "file-download.org",
          "getthatupdate.com",
          "jerseygameengine.com",
          "maiwegwurst.com",
          "migration-info.com",
          "minisnowhair.com",
          "nomatterwhat.info",
          "officeupdtcentr.com",
          "seatwowave.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.zdnet.com/article/eset-discovers-a-rare-apt-that-stayed-undetected-for-nine-years/",
        "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/",
        "https://github.com/eset/malware-ioc/tree/master/xdspy/",
        "https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf",
        "https://otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c",
        "https://cert.by/?p=1458 (Russian)"
      ],
      "total": 19
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-10-02",
      "indicators": {
        "domain": [
          "downloadsprimary.com",
          "filedownload.email",
          "theslideshare.com",
          "wildboarcontest.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.zdnet.com/article/eset-discovers-a-rare-apt-that-stayed-undetected-for-nine-years/",
        "https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/",
        "https://github.com/eset/malware-ioc/tree/master/xdspy/",
        "https://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf",
        "https://otx.alienvault.com/pulse/5f7b6dec91a6842be8aa386c",
        "https://cert.by/?p=1458 (Russian)"
      ],
      "total": 4
    }
  ]
}