🇨🇳

IndigoZebra

APT Group Information theft and espionage ETDA ✓

Also Known As

No alias recorded

Target Countries 3

Countries highlighted in red

Afghanistan Kyrgyzstan Uzbekistan

Sectors Targeted

No targeted sector recorded

Details

Origin 🇨🇳 CN

Last Updated 08 Nov 2023

MITRE ATT&CK 19

T1047 T1053.005 T1059.001 T1071.001 T1078.001 T1105 T1204 T1204.002 T1505.003 T1566 T1566.001 T1569.002 T1583 T1583.001 T1583.006 T1586 T1586.002 T1588 T1588.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 2 entries

IndigoZebra Check Point

G0136 MITRE

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Afghanistan Kyrgyzstan Uzbekistan

Description

(Check Point) Check Point Research (CPR) has observed an ongoing cyber espionage operation targeting the Afghan government. Believed to be the Chinese-speaking hacker group known as “IndigoZebra”, the threat actors behind the espionage leveraged Dropbox, the popular cloud storage service, to infiltrate the Afghan National Security Council (NSC). Further investigation by CPR revealed that this is the latest in longer-running activity targeting other Central Asian countries, Kyrgyzstan and Uzbekistan, since at least 2014.

Tools Used 1

Dropbox

Reports & References 1

https://blog.checkpoint.com/2021/07/01/cyber-espionage-on-afghanistan-kyrgyzstan-and-uzbekistan-by-chinese-speaking-hacker-group/

ETDA Profile

IndigoZebra

Origin

China

First Seen 2014

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0136/

View on ETDA APT Groups ↗