Aoqin Dragon

Aoqin Dragon is a cyberespionage threat actor active since at least 2013, primarily targeting government, education, and telecommunications organizations in Southeast Asia and Australia. Its documented targeting includes Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Its operations focus on compromising endpoints, maintaining remote access, and collecting and exfiltrating information. The group uses weaponized Microsoft Word documents exploiting CVE-2012-0158 and CVE-2010-3333, as well as executable droppers disguised as folders or antivirus software. Its document lures have included Asia-Pacific political themes. From 2018 onward, it used fake removable-device lures and malicious shortcuts distributed through USB devices. Spreader components copy malicious modules to removable media and propagate malware within compromised environments. Aoqin Dragon employs DLL hijacking and sideloading, payload encryption, Themida packing, process injection, and autostart entries for execution, defense evasion, and persistence. Aoqin Dragon's principal backdoors include Mongall and a modified version of the open-source Heyoka DNS-tunneling tool. Mongall provides remote shell access and file upload and download capabilities, with encoded or encrypted command-and-control communications. The modified Heyoka backdoor supports shell access, file operations, process management, and host discovery, using DNS tunneling for communications and exfiltration. The group also uses scripts to identify document formats and archive selected files for collection.