IndigoZebra APT continues to attack Central Asia with evolving tools

guest · Jul 1, 2021

IndigoZebra APT Hacking Campaign Targets the Afghan Government
July 1, 2021
https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html

Cybersecurity researchers are warning of ongoing attacks coordinated by a suspected Chinese-speaking threat actor targeting the Afghanistan government as part of an espionage campaign that may have had its provenance as far back as 2014.

Israeli cybersecurity firm Check Point Research attributed the intrusions to a hacking group tracked under the moniker "IndigoZebra," with past activity aimed at other central-Asian countries, including Kyrgyzstan and Uzbekistan.

"The threat actors behind the espionage leveraged Dropbox, the popular cloud-storage service, to infiltrate the Afghan National Security Council (NSC)," the researchers said in a technical write-up shared with The Hacker News, adding they "orchestrated a ministry-to-ministry style deception, where an email is sent to a high-profile target from the mailboxes of another high-profile victim."
Click to expand...

Check Point's investigation into the attacks commenced in April when NSC officials began receiving lure emails allegedly claiming to be from the Administrative Office of the President of Afghanistan.

The backdoor, dubbed "BoxCaon," is capable of stealing confidential data stored on the device, running arbitrary commands, and exfiltrating the results back to the Dropbox folder. The commands ("c.txt") themselves are placed in a separate sub-folder named "d" in the victim's Dropbox folder, which is retrieved by the malware prior to execution.
Click to expand...

Check Point Research: IndigoZebra APT continues to attack Central Asia with evolving tools

Conclusion
In this publication we unveiled the latest activity and tools of the long-running IndigoZebra operation, previously attributed to a Chinese-speaking threat actor.

In this case, we observed a cyber-espionage operation focusing on governmental agencies in Central Asia, being targeted with the Poison Ivy and xCaon backdoors, along with the newly discovered BoxCaon backdoor variant – whose C&C communication capability was updated to utilize the Dropbox service itself as the C&C infrastructure of the operation.

While the IndigoZebra actor was initially observed targeting former Soviet republics such as Uzbekistan and Kyrgyzstan, we have now witnessed that its campaigns do not dial down, but on the contrary – they expand to the new targets in the region, with a new toolset.
Click to expand...

Log in or Sign up

IndigoZebra APT continues to attack Central Asia with evolving tools

guest Guest

Log in or Sign up

IndigoZebra APT continues to attack Central Asia with evolving tools

guest Guest

Useful Searches