🇨🇳

Aoqin Dragon

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

UNC94

Target Countries 6

Countries highlighted in red

Australia Hong Kong Cambodia Myanmar Singapore Vietnam

Sectors Targeted

Public Administration 92 Telecommunications Government Educational Services 61 Information 51 Telecommunications 517 Finance and Insurance 52 Education

Details

Origin 🇨🇳 CN

Last Updated 10 Sep 2022

Malware Families 1

heyoka

MITRE ATT&CK 18

T1003 T1027 T1027.002 T1036 T1059.001 T1071.001 T1083 T1091 T1105 T1192 T1203 T1204 T1204.002 T1570 T1587 T1587.001 T1588 T1588.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

Aoqin Dragon SentinelLabs

UNC94 Mandiant

G1007 MITRE

Observed Target Countries 5

Based on ETDA data — countries highlighted in red

Australia Cambodia Hong Kong Singapore Vietnam

Description

(SentinelLabs) SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primarily targeting organizations in Southeast Asia and Australia. We assess that the threat actor’s primary focus is espionage and relates to targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. We track this activity as ‘Aoqin Dragon’. The threat actor has a history of using document lures with pornographic themes to infect users and makes heavy use of USB shortcut techniques to spread the malware and infect additional targets. Attacks attributable to Aoqin Dragon typically drop one of two backdoors, Mongall and a modified version of the open source Heyoka project.

Tools Used 1

Mongall

Reports & References 1

https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/

ETDA Profile

Aoqin Dragon

Origin

China

First Seen 2013

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G1007/

View on ETDA APT Groups ↗