xCaon
xCaon is a previously undocumented malware family associated with the IndigoZebra espionage activity. Reporting cited in the content links xCaon to campaigns targeting political entities in Kyrgyzstan and Uzbekistan, and Kaspersky’s 2017 reporting associated the broader operation with malware including Meterpreter, Poison Ivy RAT, xDown, and xCaon. Check Point identified about 30 xCaon samples, with the earliest dating back to 2014.
High-confidence behaviors described in the content indicate that xCaon used HTTP for command-and-control communications and Base64 to encode its C2 traffic. Data sent to the C2 server was also encrypted with an XOR key. The malware can upload files from victim machines. It performs host discovery by retrieving network adapter information via the Windows GetAdapterInfo() API, and it checks for the presence of Kaspersky antivirus software on the infected system.
The content further notes that xCaon was linked by Check Point to the IndigoZebra threat actor based on similarities with BoxCaon, a related backdoor used in espionage operations against the Afghan government. Only the directly stated capabilities for xCaon are included here: HTTP-based C2, Base64-encoded and XOR-protected communications, file upload from victims, network adapter enumeration, and Kaspersky AV presence checks.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
2 techniquesDuring the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
1 techniqueThe content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'
Discovery
2 techniquesThe content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.
Collection
1 techniqueCommand and Control
5 techniquesThe content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
Exfiltration
1 techniqueMany entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family linked to IndigoZebra; samples dating back to 2014 are described as HTTP-based C2 variants, used in espionage targeting political entities in Central Asia.
Malware that uses Base64 to encode command-and-control traffic.
Malware that uses Base64 to encode command-and-control traffic.
Previously unknown malware mentioned as part of the IndigoZebra campaign toolset.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.