Sophistication or missed opportunity? Analysing XE Group's long-term exploitation of zero-days with limited impact

Sophistication or missed opportunity? Analysing XE Group's long-term exploitation of zero-days with limited impact

Speakers: Justin Lentz (Threat Hunt Lead, Solis Security); Nicole Fishbein (Senior Security Researcher, Intezer)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=o-a9amLgjzU

Overview

In this compelling talk from Virus Bulletin, Justin Lentz and Nicole Fishbein dissect the enigmatic activities of the XE Group, a persistent threat actor whose recent operations raise more questions than answers about their true capabilities and objectives. The presentation, titled "Sophistication or missed opportunity? Analysing XE Group's long-term exploitation of zero-days with limited impact," unveils a previously undetected campaign spanning four years, characterized by the exploitation of two undisclosed zero-day vulnerabilities in a proprietary web application. This research challenges conventional assumptions about the group's sophistication, highlighting a puzzling blend of advanced initial access methods and seemingly underutilized long-term persistence.

Lentz and Fishbein, drawing on their expertise in threat hunting and reverse engineering, present a detailed timeline of XE Group's evolution, from their well-documented history of credit card skimming to a recent pivot towards potential information theft against a manufacturing and distribution target. The core of their discovery revolves around the group's sustained access to a compromised server from 2020 through 2024, achieved through a chained attack leveraging a SQL injection flaw and an authenticated arbitrary file upload vulnerability. This prolonged, yet largely dormant, presence prompts critical discussion on whether this represents a strategic, patient approach to espionage or a series of tactical missteps by an actor struggling to operationalize advanced access.

The talk not only sheds light on the technical intricacies of XE Group's latest campaign but also critically examines the broader implications for the cybersecurity community. It underscores significant challenges in responsible vulnerability disclosure, particularly with smaller software vendors, and emphasizes the persistent gaps in our collective understanding of certain threat groups. By posing provocative questions about XE Group's motives—ranging from state-sponsored espionage to opportunistic, yet unfulfilled, financial gain—Lentz and Fishbein compel researchers and defenders to re-evaluate their intelligence models and foster greater collaboration in tracking evolving threats.

Background

▶ Watch: Introduction: Zgroup's sophistication or missed opportunity? (0:00)

The XE Group, also known by various aliases, has been a subject of public reporting since 2020, primarily recognized for its persistent engagement in credit card skimming and credential theft. Initial reports in 2020 detailed campaigns that exploited known vulnerabilities in components like Progress Telerik UI (referred to as progress tail UI in the transcript) to deploy malicious webshells and facilitate financial fraud. A unique aspect of their early operations was their focus on ASP.NET environments, which was less common for such attacks at the time.

Subsequent in-depth analyses linked multiple credit card skimming and credential theft campaigns, revealing a consistent infrastructure and a peculiar "self-branding" where the group named their scripts and tools with the prefix "hee." These investigations also established the group's probable origins in Vietnam and suggested activity dating back as far as 2013, based on DNS and WHOIS records. This indicated a long-standing, if somewhat unsophisticated, modus operandi centered on web-based exploitation for financial gain.

A significant shift in public perception occurred with a 2023 CISA advisory, which connected the XE Group (and an unnamed AP group) to the exploitation of known vulnerabilities in Progress Telerik UI to target US government servers. This marked a notable escalation from credit card skimming to potential espionage and information collection, suggesting a broader scope of objectives. Later in 2023, another report by Mela Security highlighted the group's involvement in supply chain attacks against e-commerce platforms, again for skimming and credential theft, but also provided extensive OSINT research, revealing aliases and even an Instagram persona likely associated with the group.

Despite this growing body of intelligence, significant blind spots remained. The period between 2010 (when a malicious AutoIt script linked to the group was found) and 2020 lacked visibility, leaving a decade of activity unaccounted for. Similarly, the landscape of their operations post-2023 was unclear, prompting researchers to question the group's continued evolution and whether their objectives had truly diversified beyond their established financial motivations. The research presented by Lentz and Fishbein aimed to bridge these gaps, uncovering new campaigns and challenging the existing narrative of XE Group's capabilities.

Key Findings

▶ Watch: Discovery of new campaign and initial alert (6:20)

The research unveiled a previously undetected, long-term campaign by the XE Group, spanning from January 2020 to November 2024, which involved the exploitation of two zero-day vulnerabilities in a proprietary web application. This campaign significantly expands the known timeline and technical capabilities of the group, revealing a puzzling blend of advanced initial access and limited follow-on exploitation.

The primary discoveries include:

• Two Zero-Day Vulnerabilities: The XE Group successfully exploited a SQL injection flaw and an authenticated arbitrary file upload vulnerability in an unspecified proprietary web application. These vulnerabilities allowed them to gain initial access, dump credentials, and deploy persistent webshells.
• Long-Term Persistence (2020-2024): The group maintained access to a compromised server for over four years, demonstrating a high degree of patience and stealth. While activity was intermittent, the continuous presence of their webshells indicates a sustained foothold.
• Shift in Target and Objectives: The targeted entity was in the manufacturing and distribution sector, a departure from their traditional focus on e-commerce and credit card skimming. The exfiltration targets (config files, network enumeration) suggested an objective of information theft or espionage rather than direct financial fraud, challenging the established understanding of XE Group's motivations.
• Evolution of TTPs: Over the four-year period, the group refined its post-exploitation tactics. Initially, enumeration was manual and slow. By 2024, they developed a more efficient script to rapidly identify and exfiltrate configuration files, indicating a move towards operationalizing their exploits for broader deployment.
• Webshell Variants and User-Agent Obfuscation: The researchers identified multiple webshell variants, including one based on ASPX Spy, and observed the group employing specific user-agent strings (TM today, Zthon Zgroups) for authentication and obfuscation, although some operational security lapses were noted.
• Vendor Disclosure Challenges: The process of responsibly disclosing the discovered zero-days was significantly hampered by the vendor's unresponsiveness and lack of a formal vulnerability disclosure process, highlighting a critical industry-wide issue, particularly among smaller software developers.

These findings necessitate a re-evaluation of XE Group's sophistication, raising questions about whether their use of zero-days signifies an advanced capability, possibly acquired or outsourced, or if their subsequent limited impact points to a struggle in leveraging such access effectively.

Technical Deep Dive

▶ Watch: Technical details: SQL injection for credential dumping (9:00)

The recent campaign attributed to the XE Group began with an alert in November 2024, detecting highly suspicious activity originating from the IIS worker process on a compromised server. This included the launch of PowerShell, execution of net commands for discovery, and an attempted Meterpreter shell. Such activity from an IIS worker process is a strong indicator of a webshell compromise. While the Meterpreter attempt was unsuccessful, the threat actor proceeded to exfiltrate numerous configuration files via a script, presumably to gather credentials and enumerate the network.

A detailed analysis of the deployed webshell revealed extensive capabilities, including network scanning, command execution, and the ability to run SQL queries against server databases, often leveraging pre-built queries. A distinctive feature of the webshell was its implementation of user-agent string validation, requiring a specific string like TM today for access. Tracing this back, researchers uncovered earlier activity from January 2020, where a different webshell, a variation of ASPX Spy, was deployed. This older variant also used a user-agent string for validation, specifically Zthon Zgroups, indicating a consistent operational security (OpSec) practice by the group, albeit with evolving identifiers. The presence of both user-agent strings in later activity suggested potential compatibility across multiple webshell versions or a transition period.

The initial compromise in 2020 was facilitated by a chained exploitation of two zero-day vulnerabilities. The first was a SQL injection flaw affecting a proprietary web application. The XE Group exploited this vulnerability by manipulating the PM session one parameter in a request. Crucially, the application's error messages, triggered during a timeout warning, inadvertently exposed sensitive information, allowing the attackers to directly dump username and password credentials from the database. IIS logs confirmed the success of this exploit, showing the credentials embedded within the query information.

With authenticated access secured, the attackers proceeded to leverage the second zero-day: an authenticated arbitrary file upload vulnerability. They discovered an upload.aspx endpoint within the web application. After initially testing the endpoint by successfully uploading and fetching a benign JPEG file, they then uploaded their malicious webshells. The 2020 activity was characterized by a more manual approach to enumeration; the attackers used the webshell to individually fetch configuration files and manually navigate the file system, suggesting a less sophisticated understanding of the target application's architecture at that time.

Activity was heavy from January to March 2020, followed by a significant gap. Intermittent requests were observed in 2022, and then a new webshell was uploaded in 2023—the same variant that was detected in the November 2024 alert. This newer webshell provided enhanced visibility during investigation, as its GET requests exposed the specific files and configurations the attackers were attempting to access, unlike the more opaque older variant. The group's use of user-agent strings also showed some inconsistencies over the four-year period, with instances where they initially accessed the webshell with a generic user-agent before correcting it, hinting at occasional OpSec slips.

The disclosure of these vulnerabilities proved challenging due to the vendor's unresponsiveness and the absence of a formal vulnerability disclosure process. Researchers had to mediate through the compromised client, engage in direct calls with the vendor, and navigate the difficult process of obtaining CVE numbers through MITRE. Even after the CVEs were issued, the vendor's patch release notes were ambiguous, merely inserting the CVEs without clear advisories to customers about the severity or necessity of patching. This highlights a critical issue in the software supply chain, where smaller vendors may lack the infrastructure or understanding for effective vulnerability management, inadvertently leaving their customers exposed to sophisticated threats like the XE Group.

Demo / Proof of Concept

▶ Watch: Debating Zgroup's sophistication vs. missed opportunity (16:30)

While the talk meticulously details the mechanics of the XE Group's exploitation, including the specific vulnerabilities and the functionality of their webshells, it does not describe a live demonstration or proof of concept being performed during the conference presentation itself. Instead, the speakers focused on presenting the findings from their incident response and threat intelligence analysis, illustrating how the vulnerabilities were exploited and the webshells operated based on forensic evidence and log analysis.

Defensive Implications

▶ Watch: Final takeaways and call for community collaboration (20:40)

The detailed analysis of XE Group's long-term zero-day exploitation offers several critical defensive implications for organizations and security professionals:

1. Prioritize Patch Management and Vendor Engagement: The difficulty in vulnerability disclosure underscores the need for organizations to actively pressure their software vendors, especially smaller ones, to establish clear and responsive vulnerability disclosure programs. Customers should demand transparency in patch notes and proactive communication regarding security updates. For proprietary software without public CVEs, internal vulnerability management programs must be exceptionally robust.

1. Enhanced Monitoring of Web Server Processes: Organizations must implement granular monitoring of web server processes (e.g., IIS worker processes). Suspicious activities such as PowerShell execution, net commands, discovery tools, or attempts to launch known malware like Meterpreter from these processes are strong indicators of webshell compromise and require immediate investigation.

1. Robust Webshell Detection and Prevention: Deploy advanced webshell detection capabilities that go beyond static signatures. This includes behavioral analysis (e.g., command execution from web directories, unusual outbound connections), file integrity monitoring, and the use of Web Application Firewalls (WAFs) to detect and block common webshell patterns and command injection attempts. Logging of user-agent strings and anomalous access patterns to web application files should also be a priority.

1. Secure Development Practices and Input Validation: Developers must rigorously implement secure coding practices to prevent common web vulnerabilities. Strict input validation is crucial to mitigate SQL injection flaws, and secure file upload mechanisms must be implemented to prevent arbitrary file uploads, ensuring only authorized file types and content are accepted and stored securely outside of the web root if possible.

1. Secure Credential Management: The initial compromise relied on dumping credentials from a database. Organizations must ensure that credentials, especially for administrative accounts, are never stored in plaintext or easily retrievable formats within databases or configuration files. Implement strong hashing, salting, and secure storage mechanisms, along with multi-factor authentication (MFA) for all administrative interfaces.

1. Proactive Threat Hunting: The long dwell time of the XE Group (2020-2024) highlights the importance of proactive threat hunting. Regularly scan for persistent access mechanisms, dormant webshells, and anomalous network connections that might indicate long-term compromise, even if active exploitation is not immediately apparent.

1. Network Segmentation and Least Privilege: Limit the impact of a compromised web server through effective network segmentation. Web servers should be isolated from critical internal systems. Implement the principle of least privilege for web application service accounts, ensuring they only have the minimum necessary permissions to perform their functions, thereby limiting their ability to execute discovery commands or exfiltrate sensitive data.

1. Stay Informed on Evolving Threat Actor TTPs: Security teams should continuously update their threat intelligence on groups like XE Group. Their pivot from financial fraud to potential espionage and information theft, along with their evolving use of zero-days and automated scripts, indicates a dynamic threat landscape that requires adaptive defenses.

Key Takeaways

• XE Group's Evolving Capabilities and Objectives: The group demonstrated a significant shift from known vulnerability exploitation for financial skimming to leveraging zero-day vulnerabilities for prolonged access, potentially aiming for information theft or espionage in the manufacturing sector, challenging previous assumptions about their sophistication.
• The Paradox of Sophistication: Despite exploiting zero-days and maintaining multi-year persistence, the group's activity often appeared manual, intermittent, and with limited immediate impact, prompting questions about whether this reflects strategic patience, operational inefficiency, or a missed opportunity.
• Critical Need for Improved Vendor Disclosure: The talk highlighted severe shortcomings in software vendor vulnerability disclosure processes, particularly for smaller developers, which directly impede responsible disclosure and timely patching, leaving customers vulnerable for extended periods.
• Importance of Long-Term Threat Hunting: The four-year dwell time of the webshell underscores the necessity for continuous, proactive threat hunting and incident response to detect and eradicate persistent threats that may lie dormant for extended periods.
• Webshell Detection and Secure Development Are Paramount: Organizations must prioritize robust webshell detection mechanisms, granular monitoring of web server processes, and stringent secure coding practices to prevent SQL injection and arbitrary file upload vulnerabilities.
• Collaboration in Threat Intelligence: There remain significant gaps in understanding the XE Group's full scope, structure, and motivations. The speakers emphasized the critical need for increased collaboration and shared intelligence among researchers and security organizations to comprehensively track and counter such evolving threats.

About the Speaker(s)

Justin Lentz is a Threat Hunt Lead at Solis Security (formerly CFC Response). In his role, he focuses on actively searching for and identifying advanced threats within client environments. Beyond his professional endeavors, Justin is also an enthusiastic home brewer and hobbyist.

Nicole Fishbein serves as a Senior Security Researcher at Intezer, specializing in reverse engineering and malware analysis. Her background includes prior experience in embedded research and development, bringing a diverse skill set to her current work in understanding complex threats.