Based on the fact that we don't have a P algorithm for the discrete logarithm of the cyclic group as of 2020, but we do have an efficient algorithm for modular exponentiation. But nor do we have proof that one does not exist! Living on the edge as usual for public-key cryptography.
NP-intermediate as of 2020 for similar reasons as integer factorization.
An important case is the discrete logarithm of the cyclic group in which the group is a cyclic group.