🇨🇳

Operation Dragon Castling

APT Group Information theft and espionage 4 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 3

Countries highlighted in red

Hong Kong Philippines Province of China Taiwan

Sectors Targeted

Casinos and Gambling Gambling Industries 7132 Public Administration 92

Details

Origin 🇨🇳 CN

Last Updated 13 Apr 2026

MITRE ATT&CK 3

T1059.001 T1071.001 T1105

Related Zero-Days 4

CVE-2021-44228 CVE-2024-21412 CVE-2024-21887 CVE-2024-21893

Known Names 1 entries

Operation Dragon Castling ESET

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Hong Kong Philippines Taiwan

Description

(ESET) We recently discovered an APT campaign we are calling Operation Dragon Castling. The campaign is targeting what appears to be betting companies in South East Asia, more specifically companies located in Taiwan, the Philippines, and Hong Kong. With moderate confidence, we can attribute the campaign to a Chinese speaking APT group, but unfortunately cannot attribute the attack to a specific group and are not sure what the attackers are after.

Reports & References 1

https://decoded.avast.io/luigicamastra/operation-dragon-castling-apt-group-targeting-betting-companies/

ETDA Profile

Operation Dragon Castling

Origin

China

First Seen 2022

Motivation

Information theft and espionage

View on ETDA APT Groups ↗