From credit card fraud to zero-day exploits: Xe Group expanding cybercriminal efforts

XE Group, a decade-old cybercriminal organization, has shifted from e-commerce card-skimming to exploiting zero-day flaws in supply-chain software (VeraCore), leveraging upload validation and SQL injection flaws to implant webshells, exfiltrate data, and maintain multi-year persistence; researchers observed active exploitation in 2024, reuse of credentials from a 2020 breach, C2 infrastructure and automated data exfiltration tools, and at least one unpatched SQL flaw that elevates supply chain risk for manufacturers and distributors.