Researchers have recently observed a known state-controlled cyberespionage group targeting Russian military-industrial enterprises. XDSpy is the name of the group responsible for the recent attacks. They are threat actors that have been active since 2011 and mostly target countries in Eastern Europe and the Balkans. A report noted XDSpy hackers using phishing emails pretending to be researchers from an institute specializing in the design of nuclear weapons in order to gain access to the systems of the Russian metallurgical enterprise as well as a guided missile weapons development and production institute which proved to be unsuccessful. Some researchers see Russia as XDSpy’s primary target but there has been limited first-hand visibility into attacks on Russia because of the lack of Western companies with sight of computer systems in the region, especially after many foreign cybersecurity firms left the country following the Ukraine invasion. XDSpy attacks on Russia have none the less been recorded by a number of researchers, with records of the threat actor having previously targeted the country’s government, military, and financial institutions, along with their energy, research, and mining companies. This latest attack specifically has drawn unanimous agreement among researchers upon their attribution to XDSpy. Despite the long-standing presence of the threat actors, it has not been determined which country is backing the group. Their operational security sets them apart, having not made mistakes that compromise their identity or affiliation. The hackers don’t operate a particularly complex toolkit, but their focus on obfuscation helps them evade security solutions and likely leads to above average rates of success. The CTIX team will continue to report on threat actor activity across the world.