● Malware

BoxCaon

BoxCaon is a Windows backdoor that was used by IndigoZebra in a 2021 spearphishing campaign against Afghan government officials. BoxCaon's name stems from similarities shared with the malware family xCaon.

View graph Watch Export

Indicators tracked

Intelligence Reports20

20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium

Connections

13 relationships

T1074.001: Local Data Staging

source

T1547: Boot or Logon Autostart Execution

source

T1106: Native API

source

T1005: Data from Local System

source

T1016: System Network Configuration Discovery

source

T1083: File and Directory Discovery

source

T1041: Exfiltration Over C2 Channel

source

T1027: Obfuscated Files or Information

source

T1102.002: Bidirectional Communication

source

T1567.002: Exfiltration to Cloud Storage

source

T1059.003: Windows Command Shell

source

T1105: Ingress Tool Transfer

source