IndigoZebra is a Chinese state-sponsored threat actor targeting former Soviet republics since 2017.
IndigoZebra is a Chinese state-sponsored threat actor first disclosed in 2017, primarily targeting former Soviet Republics. It gains initial access via Spearphishing Attachments, leading to execution of Malicious Files, and uses xCaon, BoxCaon, and PoisonIvy malware for its operations. The actor engages in resource development by acquiring Domains and Tools to support its intrusions, and establishes C2 channels using Ingress Tool Transfer. Defenders should prioritize detecting targeted phishing emails with malicious attachments, monitoring for newly registered or suspicious domains, and identifying the execution of known malware like PoisonIvy and custom backdoors such as xCaon.
IndigoZebra is a Chinese state-sponsored actor mentioned for the first time by Kaspersky in its APT Trends report Q2 2017, targeting, at the time of its discovery, former Soviet Republics with multiple malware strains including Meterpreter, Poison Ivy, xDown, and a previously unknown backdoor called “xCaon.”
Monitor for suspicious domain registrations and analyze tools and binaries for malicious behavior.
Detect and block spearphishing emails with malicious attachments by inspecting email content and attachments.
Monitor for execution of malicious files by analyzing file execution patterns and user behavior.
Detect and prevent unauthorized ingress tool transfers by monitoring network traffic for suspicious file transfers.
It uses Spearphishing Attachment for initial access.
It uses xCaon, BoxCaon, and PoisonIvy malware tools.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.