BoxCaon — Malware Profile

BoxCaon is a Windows backdoor that was used by IndigoZebra in a 2021 spearphishing campaign against Afghan government officials. BoxCaon's name stems from similarities shared with the malware family xCaon.

MITRE ATT&CK techniques (12)

• T1005 Data from Local System
• T1016 System Network Configuration Discovery
• T1027 Obfuscated Files or Information
• T1041 Exfiltration Over C2 Channel
• T1059.003 Windows Command Shell
• T1074.001 Local Data Staging
• T1083 File and Directory Discovery
• T1102.002 Bidirectional Communication
• T1105 Ingress Tool Transfer
• T1106 Native API
• T1547 Boot or Logon Autostart Execution
• T1567.002 Exfiltration to Cloud Storage

Attributed threat actors

• IndigoZebra

Read the full analysis on IntelFusions