MITRE ATT&CKsoftware (malware)
S0651 BoxCaon
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2021-09-27
Description
BoxCaon is a Windows backdoor that was used by IndigoZebra in a 2021 spearphishing campaign against Afghan government officials. BoxCaon's name stems from similarities shared with the malware family xCaon.
Related
Uses · MITRE ATT&CK (12)
- T1102.002 Bidirectional Communication sub-technique
- T1074.001 Local Data Staging sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1547 Boot or Logon Autostart Execution technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1041 Exfiltration Over C2 Channel technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G0136 IndigoZebra group
References
- https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/ Checkpoint IndigoZebra July 2021
- https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html HackerNews IndigoZebra July 2021