MalwareUsed by 1 actor

BoxCaon

BoxCaon is a Windows backdoor associated with the suspected Chinese-speaking espionage actor IndigoZebra and linked by tradecraft and code lineage to the xCaon malware family. It has been used in targeted intrusions against Afghan government entities, including senior officials, as part of espionage operations that also align with earlier IndigoZebra activity against political organizations in Central Asia.

BoxCaon is designed for remote command execution, host profiling, file collection, and data exfiltration. It gathers information from compromised systems using Windows API calls, including collection of network adapter details such as the victim’s MAC address. It can create a local working directory to stage collected material, download files or enumerate folder contents on the victim system, and upload stolen files and command results from the compromised host.

A defining characteristic of BoxCaon is its abuse of Dropbox for command-and-control and exfiltration. The malware creates victim-specific folders in an attacker-controlled Dropbox account, retrieves operator tasking from that cloud-hosted structure, and sends back collected data over the same command channel. This use of a legitimate cloud service helps blend malicious traffic with normal enterprise activity and supports covert long-term espionage.

Observed delivery involved targeted spearphishing using high-trust government-themed lures and password-protected archive attachments that initiated installation of the backdoor. The malware’s functionality and operational use indicate a purpose-built espionage implant focused on persistent remote access and theft of confidential information from Windows systems in government and political environments.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

IndigoZebra

"The backdoor, dubbed 'BoxCaon,' is capable of stealing confidential data stored on the device, running arbitrary commands, and exfiltrating the results back to the Dropbox folder."

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1082System Information DiscoveryEvidence1

BoxCaon has used Windows API calls to obtain information about the compromised host.

T1083File and Directory DiscoveryEvidence5

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Collection

3 techniques

T1005Data from Local SystemEvidence2

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

T1074Data StagedEvidence1

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

T1074.001Local Data StagingEvidence1

Command and Control

3 techniques

T1102Web ServiceEvidence2

The adversaries had communicated to both Dropbox and Pastebin. APT28 has used Google Drive for C2. APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.

T1102.002Bidirectional CommunicationEvidence2

"APT39 has communicated with C2 through files uploaded to and downloaded from DropBox."; "RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results ... back to Google Drive."; "CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data"

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence6

ADVSTORESHELL exfiltrates data over the same channel used for C2.

T1567.002Exfiltration to Cloud StorageEvidence3

Akira will exfiltrate victim data using applications such as Rclone. APT41 DUST exfiltrated collected information to OneDrive. BoomBox can upload data to dedicated per-victim folders in Dropbox. During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Collects victim MAC addresses using the GetAdaptersInfo API.

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Enterprise New Software: ... BoxCaon ... xCaon

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware capable of uploading files from compromised hosts.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that uses GetAdaptersInfo to collect the victim's MAC address.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BoxCaon