MalwareUsed by 1 actor

xCaon

xCaon is a previously undocumented Windows backdoor associated with the suspected Chinese-speaking espionage cluster IndigoZebra. Samples have been observed dating back to at least 2014, and the malware has been linked to campaigns targeting political and government-related entities, including activity in Kyrgyzstan and Uzbekistan. It has also been connected by similarity to the later BoxCaon tooling used in intrusions against Afghan government targets.

xCaon supports command-and-control over HTTP and uses multiple layers of traffic obfuscation, including Base64 encoding and XOR encryption, with strings and server-supplied commands decoded before execution. On compromised hosts it performs local reconnaissance by querying network adapter information and collecting the victim system’s MAC address through native Windows API calls. It also performs security software discovery, including checks for the presence of Kaspersky antivirus, indicating basic defensive-awareness and evasion behavior.

Operationally, xCaon functions as a remote access backdoor capable of receiving commands from its operators and uploading files from victim machines, making it suitable for espionage-oriented post-compromise collection and exfiltration. Its observed tradecraft and targeting align with long-running state-linked intelligence collection operations focused on governmental and political organizations.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

IndigoZebra

"...a previously undocumented piece of malware called xCaon."

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

1 technique

T1140Deobfuscate/Decode Files or InformationEvidence6

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence6

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1082System Information DiscoveryEvidence1

BoxCaon has used Windows API calls to obtain information about the compromised host.

T1518.001Security Software DiscoveryEvidence3

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Collection

1 technique

T1005Data from Local SystemEvidence2

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

Command and Control

7 techniques

T1001Data ObfuscationEvidence1

Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.

T1071.001Web ProtocolsEvidence5

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence3

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence1

T1573Encrypted ChannelEvidence1

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

T1573.001Symmetric CryptographyEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Uses GetAdaptersInfo to retrieve victim MAC addresses.

mitre attack websiteNews

Oct 21, 2021

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Backdoor that uses GetAdaptersInfo to obtain the victim's MAC address.

mitre attack websiteNews

Oct 21, 2021

Encrypted Channel: Symmetric Cryptography, Sub-technique T1573.001 - Enterprise | MITRE ATT&CK®

Backdoor that encrypts data sent to its C2 server using XOR.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1005 - Enterprise | MITRE ATT&CK®

Malware that uploads files from victim machines.

+16 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

xCaon