IndigoZebra
IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.[1][2][3]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.[1] |
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.[2] |
| .006 | 获取基础设施: Web Services |
IndigoZebra created Dropbox accounts for their operations.[1][2] |
||
| Enterprise | T1588 | .002 | 获取能力: Tool |
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.[2][3] |
| Enterprise | T1586 | .002 | 账号妥协: Email Accounts |
IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.[2] |
| Enterprise | T1105 | 输入工具传输 |
IndigoZebra has downloaded additional files and tools from its C2 server.[2] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.[1][2] |