IndigoZebra

IndigoZebra is a threat actor tracked in campaigns targeting former Soviet republics and other Central Asian countries, including Kyrgyzstan and Uzbekistan. Check Point Research attributed intrusions to IndigoZebra and reported that the activity shared ties with other Chinese-speaking actors. Reported malware and tooling associated with the group include Meterpreter, Poison Ivy, xDown, and xCaon, and the group has also used open-source tools such as NBTscan and Meterpreter. IndigoZebra has conducted spearphishing operations using compromised legitimate email accounts and malicious attachments, including password-protected RAR archives and attachments that urged recipients to review file modifications, relying on user execution to trigger infection. The group downloaded additional files and tools from command-and-control servers, established operational domains including some designed to resemble official government domains, and created Dropbox accounts for operational use. ATT&CK techniques directly reflected in the content include spearphishing attachment, malicious file execution, ingress tool transfer, obtain capabilities: tool, acquire infrastructure: domains, acquire infrastructure: web services, and compromise accounts: email accounts.