Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · DragonOK · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

DragonOK

  • Moafee
  • BRONZE OVERBROOK
  • G0017
  • G0002
  • Shallow Taurus

state sponsor · ChinaMITRE G0017 ↗

DragonOK — ATT&CK roseDR

attack rose · 1 techniques across 1 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2015-1641

Analyst brief

misp-galaxy + mitre-attack

Threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. 2223 It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.

Observed targets (as stated by the sources)

1 countries · 1 sectors
United StatesAssessed origin: China

assessed origin · Chinaobserved targets · 1

countries · 1

  • United States

sectors · 1

  • Private sector

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

1 techniques · 1 of 15 tactics

  1. Stealth

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
PoisonIvyS0012 ↗
PlugXS0013 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs DragonOK is cited as exploiting

none on KEV
  1. CVE-2015-16412026-10-17
    1. “Sysget malware was delivered both directly via phishing emails, as well as in Rich Text Format (RTF) documents exploiting the CVE-2015-1641 vulnerability (patched in MS15-033 ) that in turn leveraged a very unique shellcode.”

      cited as exploiting · named nearby · source: unit42.paloaltonetworks.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2017DragonOK Updates Toolset and Targets Multiple Geographic RegionsPalo Alto Networks ↗

Take it with you

keyless · no signup

References

17 sources
  1. 1.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs…
  2. 2.attack.mitre.org/wiki/Groups
  3. 3.forcepoint.com/de/blog/x-labs/trojanized-adobe-installer-used-install…
  4. 4.github.com/m0n0ph1/APT_CyberCriminal_Campagin_Collections-1/blob/…
  5. 5.cfr.org/interactive/cyber-operations/moafee
  6. 6.unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deplo…
  7. 7.unit42.paloaltonetworks.com/unit42-dragonok-updates-toolset-targets-multiple-geogr…
  8. 8.phnompenhpost.com/national/kingdom-targeted-new-malware
  9. 9.attack.mitre.org/groups/G0017
  10. 10.attack.mitre.org/groups/G0002
  11. +7 more in the JSON record

Track DragonOK on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.