FORENSIA

THREAT_ACTOR · G0136

IndigoZebra

Also known as: IndigoZebra

Profile

IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.

MITRE ATT&CK ↗

Techniques

7 ATT&CK techniques attributed to this actor.

T1105 Ingress Tool TransferT1204.002 Malicious FileT1566.001 Spearphishing AttachmentT1583.001 DomainsT1583.006 Web ServicesT1586.002 Email AccountsT1588.002 Tool

Software

3 malware/tools attributed to this actor.

PoisonIvyBoxCaonxCaon

Related corpus activity

8,878 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to IndigoZebra.

IndicatorTypeFamilySevSrc
cve-2025-7443cve—851
cve-2026-3102cve—853
cve-2018-8007cve—851
cve-2025-34085cve—851
cve-2022-47945cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2024-1781cve—851
cve-2026-1969cve—851
cve-2025-12057cve—851
cve-2017-17215cve—852
cve-2025-7852cve—851
cve-2026-3844cve—851
cve-2026-0740cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2025-23304cve—852
cve-2025-68670cve—852
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525sha256phishing802
669002654c264191d4660fbf757860d930175649735f81370b9f1af3658a304csha256phishing802
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21sha256—801
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194sha256phishing802
7105caa6d4fd8a2c67523d385277528e556ae4f6hash—802
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470sha256—801
221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9sha256—801
c2eb1033bc01ab0fd732a7ba4967be02c0690bf0hash—802
6c6cbed6aad96564ed87094785be07a1hashphishing802
82e579bd49d69845133c9aa8585f8bd26736437bhash—802
55d6238b01a177e25eb7d53c943f3abea64ec073hashphishing802
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5casha256phishing802

Showing the top 30 by severity of 8,878.