XDSpy Cybercriminals Exploit Windows LNK Zero-Day Vulnerability to Target Windows System Users

The persistent state-aligned threat group XDSpy has been observed exploiting a zero-day vulnerability (ZDI-CAN-25373) in Microsoft Windows LNK file handling.

This flaw, discovered amid XDSpy’s campaign in March 2025, enables malicious actors to obscure executed commands within specifically crafted shortcut (.lnk) files, evading both user scrutiny and many security tools.

The ongoing campaign predominantly targets government and institutional entities in Eastern Europe, with confirmed infections in Belarus and strong indications of a broader regional focus.

Technical Exploitation of Windows LNK Weakness

The core of the campaign leverages the ZDI-CAN-25373 vulnerability a bug in how Windows Explorer displays LNK target paths and command-line arguments.

By padding arguments with excessive whitespace and certain ASCII control characters, attackers can push malicious execution directives out of visible range in the UI, preventing administrators and analysts from easily detecting suspicious activity through standard file property dialogs.

Notably, XDSpy’s LNK files are engineered to take advantage of inconsistencies between Microsoft’s official MS-SHLLINK parsing specification and the actual Windows implementation, further thwarting third-party forensic tools that follow the documented standard.

Specifically, when the total command length reaches the Windows-imposed 259-character limit and is suffixed with at least 78 spaces, arguments are concealed, but still interpreted and executed by the OS.

According to Harfang Labs Report, this enables stealthy delivery of complex payloads while presenting benign or empty targets to the user.

Multi-Stage Infection Chain

XDSpy’s infection chain begins with spear-phishing emails containing ZIP archives named in Russian, typically embedding a decoy document and a malicious LNK file.

Upon user interaction, the LNK launches a legitimate signed Microsoft executable, which sideloads a first-stage downloader DLL (ETDownloader, typically named d3d9.dll).

This loader establishes persistence, opens decoy content to distract the user, and retrieves a second-stage payload a Go-based data exfiltration implant known as XDigo.

The attack flow exhibits a high level of automation and anti-detection measures:

• Stage 1: The sideloaded ETDownloader downloads and decodes the XDigo implant, moves itself and its components to hidden locations, and sets up Windows startup persistence.
• Stage 2: XDigo conducts extensive anti-analysis checks, collects sensitive files (Office documents, archives, desktop TXT files), clipboard data, and screenshots, then exfiltrates this information to remote command-and-control (C2) infrastructure over HTTPS. It can also execute arbitrary commands issued by the operators via encrypted C2 communications.

Importantly, the campaign uses infrastructure that overlaps with previously attributed XDSpy operations, including consistent use of Russian-themed domain naming for distribution and random English-themed names for C2, often hosted through commercial VPS and CDN providers using Let’s Encrypt certificates.

XDSpy’s focus on government, economic, and infrastructure-related institutions in Belarus and neighboring regions aligns with previously documented objectives.

The group’s technical sophistication from exploitation of zero-day UI bugs to custom sideloading and anti-sandbox techniques underscores their capabilities and dedication to operational security.

Despite limited public reporting in Western cybersecurity circles, these ongoing campaigns highlight the continued risk posed by advanced persistent threat actors leveraging both software flaws and intricate social engineering.

The discovery and analysis of these attacks were facilitated by cross-referencing malware samples, infrastructure pivots, and forensic data from both public scanners and targeted victim environments.

Notably, the campaign remains active, with ongoing infrastructure updates and fresh, evolving malware samples.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates