The XE Group, a cybercriminal organization active for over a decade, has evolved from credit-card skimming to exploiting zero-day vulnerabilities, posing increased risks to global supply chains, particularly in manufacturing and distribution sectors. Initially identified in 2013 for targeting e-commerce platforms, the group has refined its methods over time. They previously exploited known vulnerabilities in tools like Telerik UI for ASP.NET, using webshells for remote access and data theft. By 2024, XE Group shifted its focus to targeted information theft, exploiting two (2) zero-day vulnerabilities in VeraCore, a supply chain management software. These vulnerabilities, an upload validation flaw and a SQL injection flaw, enabled the group to infiltrate systems and exfiltrate configuration files, maintaining access for years. A notable incident in 2024 saw the reactivation of a webshell planted in a 2020 breach, highlighting the group’s patience and operational discipline. The Common Vulnerabilities and Exposures (CVEs) for these flaws are pending validation from MITRE, though a temporary fix for the upload validation flaw was issued in November by VeraCore’s parent company, Adavantive. However, the SQL flaw remains unpatched. The group’s infrastructure includes domains for command-and-control and skimming tools, used to automate their tactics. In 2020, XE Group extracted database credentials through obfuscated Transact-SQL queries to upload malicious files. They have employed customized open-source webshells like ASPXSpy for file manipulation and network scanning. By 2024, their tools incorporated automated data exfiltration and PowerShell-based payload delivery. Recent campaigns utilized Windows utilities like arp and netstat for network mapping, with PowerShell scripts deploying Meterpreter malware to establish covert communication channels. XE Group’s ability to maintain system access for over four (4) years indicates a preference for persistence over immediate monetization, allowing for prolonged intelligence gathering or staging larger attacks. Research suggests the group is likely based in Vietnam, supported by Vietnamese-linked email addresses and pseudonyms like “XeThanh.” Despite minimal efforts to obscure its identity, XE Group’s lack of operational security suggests it is not state-aligned, as state-backed groups typically exercise stricter security measures.