Loading story…
Kaspersky detailed activity attributed to the Spring Dragon advanced persistent threat, describing a long-running cyber-espionage campaign focused on targets in Asia. The group was reported to use spearphishing and other targeted intrusion techniques to compromise organizations, then deploy malware and supporting tools to maintain access, move within victim environments, and collect sensitive information.
The report linked Spring Dragon to operations against government and political entities as well as other strategic sectors, portraying the actor as a persistent espionage threat rather than a financially motivated criminal group. Researchers said the campaign relied on tailored malware and operational tradecraft designed for stealth and long-term access, underscoring the risk posed by regionally focused APT actors conducting intelligence collection against high-value organizations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report titled "The Spring Dragon APT." No additional incident details or dated real-world events are provided in the reference content supplied.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026
The **DragonOK** espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including **PlugX** variants, **Sysget**, **IsSpace**, and **TidePool**. Researchers tied a PlugX variant known as **PIPX** to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia. The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting **`CVE-2015-1641`**, alongside techniques such as **DLL sideloading**, code injection into **`nslookup.exe`**, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as **`HKLM\SOFTWARE\BINARY`** or **`HKCU\SOFTWARE\BINARY`** instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Aug 15, 2026
Researchers uncovered **Operation Dragon Weave**, a spearphishing espionage campaign targeting officials and citizens in **Taiwan** and the **Czech Republic** with region-specific lures. Victims received ZIP archives that triggered one of two infection chains: a malicious `.lnk` file launching a VBScript-and-PowerShell sequence, or a Rust-based dropper that unpacked components directly. Both paths led to DLL sideloading of a malicious `UnityPlayer.dll`, a Rust loader dubbed **RUSTCLOAK** that decrypted and executed the next-stage payload entirely in memory. The final payload, **AZUREVEIL**, was identified as an Adaptix C2 agent that used **Microsoft Azure Blob Storage** as a dead-drop command-and-control channel over HTTPS, allowing encrypted tasking, data exfiltration, and in-memory BOF execution while blending into legitimate cloud traffic. Seqrite reported anti-analysis checks, multilayer payload encryption, and a hardcoded Azure SAS token valid for a year, indicating an effort to preserve stealth and persistence. Based on the targeting, tooling, and tradecraft, researchers assessed with moderate confidence that the operation is linked to a **China-based threat actor**, though no specific group was named.
Jun 29, 2026