A cyber-espionage group using USB-based pornographic lures to target government entities in Southeast Asia and Australia.
Analyst brief
Aoqin Dragon (UNC94) is a cyber-espionage group active since at least 2013, targeting government, education, and telecommunications sectors in Southeast Asia and Australia. The actor uses document lures with pornographic themes to deploy backdoors like Mongall and Heyoka Backdoor, and relies on USB shortcut techniques for lateral movement. Observed TTPs include software packing, masquerading, and exploitation for client execution. Defenders should prioritize USB autorun restrictions, patch client-side execution vulnerabilities, and monitor for lateral tool transfer and suspicious document files.
Aoqin Dragon
UNC94
unknown
SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primarily targeting organizations in Southeast Asia and Australia. They assess that the threat actor's primary focus is espionage and relates to targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. We track this activity as 'Aoqin Dragon'. The threat actor has a history of using document lures with pornographic themes to infect users and makes heavy use of USB shortcut techniques to spread the malware and infect additional targets. Attacks attributable to Aoqin Dragon typically drop one of two backdoors, Mongall and a modified version of the open source Heyoka project.
Monitor device connections and network activity to detect replication through removable media and lateral tool transfer.
FAQ2
Which regions and sectors are primarily targeted by Aoqin Dragon (UNC94)?+
Aoqin Dragon primarily targets the government, education, and telecommunications sectors in Southeast Asia (Cambodia, Hong Kong, Singapore, Vietnam) and Australia.
What are the main spreading methods used by Aoqin Dragon?+
The group uses document lures with pornographic themes to trick users and spreads via USB shortcut techniques to perform lateral movement across networks.