DragonOK

🔴 High
Also known as: BRONZE OVERBROOK, Bronze Overbrook, Dragon Castling, DragonOK, G0002, G0017, Moafee, Shallow Taurus

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. Operation Quantum Entanglement It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. New DragonOK

🌍 Country China
📅 Activity 2017 — 2022
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0017
Private sector
2017
2022

Targeted Victims

United States

Associated Operations

2015-01 2016 2017 2017-01 All five phishing campaigns targeted a Japanese manufacturing firm over the course of two months Cybersecurity expert Niklas Femerstrand in an email yesterday pointed out that while servers in several different countries appear to be the origin the attack In recent months Japan This campaign involved five separate phishing attacks Tibet and Russia Unit 42 has observed a number of attacks that we attribute to this group. Multiple new variants of the previously discussed sysget malware family have been observed in use by DragonOK. Sysget malware was delivered both directly via phishing emails adding that there are “strong indications” the campaign is “an operation funded by China”. also known as HelloBridge. The malware was included as an attachment intended to trick the user into opening the malware. and political organizations in Cambodia since at least January as well as in Rich Text Format (RTF) documents exploiting the CVE-2015-1641 vulnerability that in turn leveraged a very unique shellcode. but the final campaign also targeted a separate Japanese high-tech organization. each carrying a different variant of Sysget malware https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/ https://unit42.paloaltonetworks.com/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/ https://www.phnompenhpost.com/national/kingdom-targeted-new-malware it has been linked to the DragonOK campaign. “The DragonOK campaign has previously [in 2014] targeted organizations in Taiwan ” he wrote

Introduction

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. Operation Quantum Entanglement It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. New DragonOK

Activities and Tactics

Targeted Sectors: Private sector

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2017

Last Activity: 2022

Incident Type: Espionage

Suspected Victims: United States

Notable Campaigns

  • 2015-01
  • 2016
  • 2017
  • 2017-01
  • All five phishing campaigns targeted a Japanese manufacturing firm over the course of two months
  • Cybersecurity expert Niklas Femerstrand in an email yesterday pointed out that while servers in several different countries appear to be the origin the attack
  • In recent months
  • Japan
  • This campaign involved five separate phishing attacks
  • Tibet and Russia
  • Unit 42 has observed a number of attacks that we attribute to this group. Multiple new variants of the previously discussed sysget malware family have been observed in use by DragonOK. Sysget malware was delivered both directly via phishing emails
  • adding that there are “strong indications” the campaign is “an operation funded by China”.
  • also known as HelloBridge. The malware was included as an attachment intended to trick the user into opening the malware.
  • and political organizations in Cambodia since at least January
  • as well as in Rich Text Format (RTF) documents exploiting the CVE-2015-1641 vulnerability that in turn leveraged a very unique shellcode.
  • but the final campaign also targeted a separate Japanese high-tech organization.
  • each carrying a different variant of Sysget malware
  • https://unit42.paloaltonetworks.com/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/
  • https://unit42.paloaltonetworks.com/unit42-dragonok-updates-toolset-targets-multiple-geographic-regions/
  • https://www.phnompenhpost.com/national/kingdom-targeted-new-malware
  • it has been linked to the DragonOK campaign.
  • “The DragonOK campaign has previously [in 2014] targeted organizations in Taiwan
  • ” he wrote

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • PlugX
  • PoisonIvy
  • CVE-2015-1641:
  • Sysget:
  • IsSpace:
  • Rambo Backdoor:
  • FormerFirstRAT:
  • HTran:
  • KHRAT:
  • Mongall:
  • NFlog:
  • NewCT:
  • PlugX:
  • Poison Ivy:
  • Rambo:
  • TidePool:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] Operation Quantum Entanglement Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024. [4] New DragonOK Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.