Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Aoqin Dragon · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

Aoqin Dragon

  • UNC94

MITRE G1007 ↗

Aoqin Dragon — ATT&CK roseAD

attack rose · 9 techniques across 5 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2010-3333, CVE-2012-0158

Analyst brief

misp-galaxy + mitre-attack

SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primarily targeting organizations in Southeast Asia and Australia. They assess that the threat actor's primary focus is espionage and relates to targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. We track this activity as 'Aoqin Dragon'.

The threat actor has a history of using document lures with pornographic themes to infect users and makes heavy use of USB shortcut techniques to spread the malware and infect additional targets. Attacks attributable to Aoqin Dragon typically drop one of two backdoors, Mongall and a modified version of the open source Heyoka project.

Observed targets (as stated by the sources)

5 countries · 3 sectors
AustraliaCambodiaHong KongSingaporeVietnamAssessed origin: China

assessed origin · Chinaobserved targets · 5

countries · 5

  • Australia
  • Cambodia
  • Hong Kong
  • Singapore
  • Vietnam

sectors · 3

  • Government
  • Education
  • Telecommunications

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 5 of 15 tactics

  1. Resource development

    2 techniques

  2. Execution

    2 techniques

  3. Stealth

    2 techniques

  4. Discovery

    1 technique

  5. Lateral movement

    2 techniques

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
MongallS1026 ↗
Heyoka BackdoorS1027 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Aoqin Dragon is cited as exploiting

none on KEV
  1. CVE-2010-33332026-10-17
    1. “During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.”

      cited as exploiting · source: sentinelone.com ↗ · 2026-10-17

    2. “Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2012-01582026-10-17
    1. “During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.”

      cited as exploiting · source: sentinelone.com ↗ · 2026-10-17

    2. “Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

3 sources
  1. 1.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-…
  2. 2.khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf
  3. 3.attack.mitre.org/groups/G1007

Track Aoqin Dragon on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.