DragonOK
threat actorCN01
also known as
Other names and identifiers for this entity.
ATT&CK
DragonOK
MISP
BRONZE OVERBROOK · DragonOK · Moafee · Shallow Taurus
Threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. 2223 It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.
02
resolved ATT&CK groups
Threat groups associated with this.
03
software used (2)
Malware and tools associated with this.
04
references
External citations — patches, advisories, analysis.
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf
- https://attack.mitre.org/wiki/Groups
- https://www.forcepoint.com/de/blog/x-labs/trojanized-adobe-installer-used-install-dragonok-s-new-custom-backdoor
- https://github.com/m0n0ph1/APT_CyberCriminal_Campagin_Collections-1/blob/master/2017/2017.02.15.deep-dive-dragonok-rambo-backdoor/Deep%20Dive%20on%20the%20DragonOK%20Rambo%20Backdoor%20_%20Morphick%20Cyber%20Security.pdf
- https://www.cfr.org/interactive/cyber-operations/moafee
- https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/
- https://unit42.paloaltonetworks.com/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/
- https://www.phnompenhpost.com/national/kingdom-targeted-new-malware