Loading story…
The China-linked threat actor known as Ink Dragon, also tracked as Jewelbug, has intensified its cyberespionage operations against government and telecommunications organizations across Europe, Asia, and Africa. Recent campaigns have involved the compromise of internet-exposed web applications, such as misconfigured Microsoft IIS and SharePoint servers, to establish initial access. Once inside, the attackers deploy web shells and backdoors, including FINALDRAFT and NANOREMOTE, to facilitate command-and-control, lateral movement, and data exfiltration. The group has demonstrated advanced operational security by blending malicious activity with legitimate enterprise traffic, using platform-native tools, and leveraging compromised servers as relay nodes to expand their reach and maintain persistence.
Check Point Research and other security firms have observed that Ink Dragon's tactics include credential harvesting, the use of existing accounts for stealthy lateral movement, and the installation of implants that store sensitive data. The FINALDRAFT backdoor has been updated to better evade detection by mimicking Microsoft cloud activity and restricting its communications to business hours. The campaign has impacted several dozen victims, with the attackers focusing on long-term access and data theft while minimizing their operational footprint to avoid detection by defenders.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 said Check Point's findings aligned with its own intelligence and noted an increase in Ink Dragon activity in recent months. This served as external corroboration of the campaign's scale and tempo.
In mid-December 2025, Check Point's findings were published, detailing Ink Dragon's expansion into European government networks, use of relay-node infrastructure, and updated malware. The disclosure also highlighted stealthy post-exploitation tactics such as credential theft, lateral movement, and AD data exfiltration.
Check Point identified a second China-linked actor, REF3927 or RudePanda, in several overlapping victim networks. Researchers assessed overlap in access methods but found no evidence of direct operational coordination with Ink Dragon.
Check Point observed a new FINALDRAFT variant for Windows and Linux that abuses Outlook drafts and Microsoft Graph API for covert command and control. The malware blended with legitimate Microsoft cloud activity and supported long-term stealthy access.
After gaining access, Ink Dragon installed custom IIS modules, including a ShadowPad IIS Listener, to turn victim servers into relay nodes for command-and-control traffic. The mesh helped obscure the origin of operations and supported further intrusions against additional targets.
The espionage campaign affected several dozen victims across Europe, Asia, and Africa, including government and telecommunications organizations. Attackers exploited internet-exposed IIS, SharePoint, and ASP.NET ViewState weaknesses and misconfigurations for initial access.
Since July 2025, Ink Dragon increasingly targeted European government networks while continuing operations in Southeast Asia and South America. This was described as the first observed targeting of European networks by the group.
Check Point said the China-aligned cluster tracked as Ink Dragon, Jewelbug, Earth Alux, and REF7707 has been active since at least March 2023. Earlier operations focused on regions including Southeast Asia and South America before later expansion into Europe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcecsoonline.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
The **DragonOK** espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including **PlugX** variants, **Sysget**, **IsSpace**, and **TidePool**. Researchers tied a PlugX variant known as **PIPX** to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia. The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting **`CVE-2015-1641`**, alongside techniques such as **DLL sideloading**, code injection into **`nslookup.exe`**, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as **`HKLM\SOFTWARE\BINARY`** or **`HKCU\SOFTWARE\BINARY`** instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Aug 15, 2026