2attributed CVEs
12ATT&CK techniques
6.4IDF score (tooling uniqueness)
0exclusive CVEs
2026years active
About this actor
IndigoZebra is a Chinese state-sponsored actor mentioned for the first time by Kaspersky in its APT Trends report Q2 2017, targeting, at the time of its discovery, former Soviet Republics with multiple malware strains including Meterpreter, Poison Ivy, xDown, and a previously unknown backdoor called “xCaon.”
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
G0136
Unclassifiedno scheme matched
IndigoZebra
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 12 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
- 2026 — 2 CVE published
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2026-31635 | 6.0 | 7.5 | 0.0082 | 2026-04-24 | see CVE |
CVE-2026-45585 | 5.5 | 6.8 | 0.0135 | 2026-05-20 | see CVE |
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
AC-4 | 5 / 12 | 42% |
CA-7 | 5 / 12 | 42% |
CM-2 | 5 / 12 | 42% |
CM-6 | 5 / 12 | 42% |
SC-7 | 5 / 12 | 42% |
SI-3 | 5 / 12 | 42% |
SI-4 | 5 / 12 | 42% |
SC-44 | 4 / 12 | 33% |
SI-8 | 4 / 12 | 33% |
CM-7 | 3 / 12 | 25% |
SI-2 | 3 / 12 | 25% |
IA-9 | 2 / 12 | 17% |
SC-20 | 2 / 12 | 17% |
SI-10 | 2 / 12 | 17% |
SI-7 | 2 / 12 | 17% |
Co-occurring actors
- Operation Dream Job 2 shared CVEs
- Threat Group-3390 2 shared CVEs
Similar actors
Similar TTPs
- Ferocious Kitten 0.53
- APT30 0.33
- DarkHydrus 0.33
- BITTER 0.31
- Star Blizzard 0.30
Overlapping CVEs
- Operation Dream Job 0.67
- Threat Group-3390 0.40
Active in same years
- Operation Dream Job 1.00
- SolarWinds Compromise 1.00
- C0027 1.00
- SharePoint ToolShell Exploitation 1.00
- Ke3chang 1.00
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00