IndigoZebra APT continues to attack Central Asia with evolving tools

Introduction

Check Point research recently discovered an ongoing spear-phishing campaign targeting the Afghan government. Further investigation revealed this campaign was a part of a long-running activity targeting other Central-Asia countries, including Kyrgyzstan and Uzbekistan, since at least 2014. The actor suspected of this cyber-espionage operation is an APT group dubbed “IndigoZebra“, previously attributed by researchers to China. The technical details of the operation were not publicly disclosed before. In this article, we will discuss the tools, TTPs and infrastructure used by the attacker during the years of its activity. We will al…