Sophistication or missed opportunity? Analysing XE Group's long-term exploitation of zero-days with limited impact

Friday 26 September 11:00 - 11:30, Green room

Justin Lentz (Solis Security) & Nicole Fishbein (Intezer)

The discovery of a threat actor leveraging multiple zero-day vulnerabilities to infiltrate a target over a four-year period typically signals a highly sophisticated and well-resourced adversary. However, what happens when there is no financial gain, no data exfiltration, and seemingly minimal impact on the victim organization? Was this a case of a failed operation, an intelligence-driven foothold, or something else entirely?

This talk will dive into the operational tradecraft of a threat actor who successfully exploited zero-day vulnerabilities to maintain long-term persistence but left behind little evidence of monetization or destruction. We will explore the technical execution of the zero-day exploitation and persistence mechanism, the possible motivations behind the prolonged yet low-impact operation, indicators of whether this was an espionage campaign, a failed attempt at lateral movement, or a staging ground for future activity, and the missed opportunity – did the attacker miscalculate, or was their objective never financial in nature?

By dissecting this unusual case, we challenge traditional assumptions about threat actor intent, the evolution of covert access strategies, and the implications for cyber defenders dealing with stealthy, non-disruptive adversaries. Was this a masterclass in restraint, or did the attacker simply fail to capitalize on their access?

Back to VB2025 Programme page

Back to VB2025 conference page

Other VB2025 papers