IndigoZebra

IndigoZebra is a threat actor tracked for operations targeting former Soviet republics and other Central Asian countries, including Kyrgyzstan and Uzbekistan. Check Point Research attributed intrusions to IndigoZebra, and the content describes ties to other Chinese-speaking actors. Reported malware and tools associated with the campaign include Meterpreter, Poison Ivy, xDown, and xCaon. IndigoZebra used spearphishing emails with malicious attachments, including password-protected RAR files, and lures urging recipients to review modifications in a file, relying on user execution to trigger infection. The group compromised legitimate email accounts for spearphishing, downloaded additional files and tools from command-and-control servers, acquired open-source tools including NBTscan and Meterpreter, established operational domains including some designed to resemble official government domains, and created Dropbox accounts for operations. The content maps IndigoZebra activity to spearphishing attachment, malicious file execution, ingress tool transfer, compromised email accounts, and acquisition of domains, web services, and tools.