VB2020 paper: XDSpy: stealing government secrets since 2011

The VB2020/XDSpy paper by ESET documents a nine-year espionage campaign by the XDSpy group against Eastern European and Balkan government entities, powered by a modular malware suite that exfiltrates documents, monitors devices, and uses hard-coded C2s; it details spear-phishing delivery, the XDSpy plug-ins (XDRecon, XDList, XDMonitor, XDUpload, XDLoc, XDPass), persistence techniques, comprehensive IOCs, and indicators of compromise.