Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · IndigoZebra · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

IndigoZebra

MITRE G0136 ↗

IndigoZebra — ATT&CK roseIN

attack rose · 7 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

IndigoZebra is a Chinese state-sponsored actor mentioned for the first time by Kaspersky in its APT Trends report Q2 2017, targeting, at the time of its discovery, former Soviet Republics with multiple malware strains including Meterpreter, Poison Ivy, xDown, and a previously unknown backdoor called “xCaon.”

Kill chain

MITRE ATT&CK Enterprise · tap a technique

7 techniques · 4 of 15 tactics

  1. Resource development

    4 techniques

  2. Initial access

    1 technique

  3. Execution

    1 technique

  4. Command and control

    1 technique

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
xCaonS0653 ↗
BoxCaonS0651 ↗
PoisonIvyS0012 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

5 sources
  1. 1.research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-…
  2. 2.rewterz.com/rewterz-news/rewterz-threat-intel-indigozebra-apt-grou…
  3. 3.securelist.com/apt-trends-report-q2-2017/79332
  4. 4.attack.mitre.org/groups/G0136
  5. 5.thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html

Track IndigoZebra on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.