DragonOK

DragonOK is a Chinese cyber-espionage threat group assessed to operate from Jiangsu, China and known for sustained targeting of organizations in East Asia, especially Japan and Taiwan. Reported victim sectors include manufacturing, high technology, semiconductors, energy, and government-related entities, with activity also extending to victims of interest connected to Tibet and Russia. DragonOK has been publicly linked to malware families including Sysget (also known as HelloBridge), IsSpace, NFlog, TidePool, PlugX, PoisonIvy, NewCT, FormerFirstRAT, FF-RAT, PIPX, and Rambo. Some reporting also notes connections between DragonOK and clusters or activity referred to as Bronze Overbrook, Danti, and Rancor. DragonOK commonly relies on spearphishing with decoy documents and malicious attachments, and has also used malicious RTF documents exploiting Microsoft Office vulnerabilities and watering-hole compromises. The group is notable for repeated abuse of DLL sideloading using legitimate signed software, including tradecraft involving PotPlayer and VMware-related binaries, as well as process injection and multi-stage loaders. Its malware has demonstrated persistence through Run-key mechanisms, service installation, startup-folder execution, and PowerShell-based autoruns. DragonOK tooling supports host reconnaissance, command execution, file upload and download, payload staging, and data exfiltration. Observed samples also include anti-debugging, anti-virtual-machine, emulator-evasion, encrypted configuration storage, and obfuscated command-and-control communications. Sysget has served as a recurring first-stage implant in DragonOK operations, often used to establish footholds and retrieve additional backdoors. Later variants incorporated stronger encryption, modified network protocols, and anti-analysis features. IsSpace appears closely related to NFlog and has been used both in exploit-driven delivery chains and in later phishing campaigns, with capabilities including system profiling, command execution, file operations, and credential-related proxy collection. PlugX variants associated with DragonOK have used DLL sideloading, registry-stored payloads, service-based persistence, and code injection into legitimate processes. FormerFirstRAT and Rambo illustrate the group’s use of custom backdoors for post-compromise control, reconnaissance, and exfiltration. DragonOK’s activity is consistent with long-term intelligence collection rather than financially motivated crime. Its operational pattern emphasizes targeted intrusion, stealthy persistence, modular follow-on tooling, and continued refinement of malware families over multiple years.