# Aoqin Dragon: threat group profile

> Aoqin Dragon is a threat group thought to operate from China. Public reporting links it to 9 attack techniques, and to attacks on government, education and telecommunications organisations, with 5 countries and victims named. This free profile shows how it works and who it targets, so you can judge the risk to you.

Canonical page: https://www.precursorintelligence.com/threat-actors/aoqin-dragon
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Threat groups](https://www.precursorintelligence.com/threat-actors) > Aoqin Dragon

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 9 (plus 5 sub-techniques) |
| Countries and victims named | 5 |
| Thought to operate from | China |
| Other names | 1 |
| Public reports | 2 |

## Who is Aoqin Dragon?

Aoqin Dragon is a threat group thought to operate from China. Public reporting links it to 9 attack techniques, and to attacks on government, education and telecommunications organisations, with 5 countries and victims named.

### Also known as

UNC94

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primarily targeting organizations in Southeast Asia and Australia. They assess that the threat actor's primary focus is espionage and relates to targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. We track this activity as 'Aoqin Dragon'. The threat actor has a history of using document lures with pornographic themes to infect users and makes heavy use of USB shortcut techniques to spread the malware and infect additional targets. Attacks attributable to Aoqin Dragon typically drop one of two backdoors, Mongall and a modified version of the open source Heyoka project.

## How does Aoqin Dragon attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 9 linked to Aoqin Dragon. Some techniques belong to more than one stage. Public reporting also lists 5 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (2)

- T1587: Develop Capabilities
- T1588: Obtain Capabilities

### 3. Getting in (1)

- T1091: Replication Through Removable Media

### 4. Running code (2)

- T1203: Exploitation for Client Execution
- T1204: User Execution

### 5. Staying in (0)

- None linked in public reporting.

### 6. Taking control (0)

- None linked in public reporting.

### 7. Hiding (2)

- T1027: Obfuscated Files or Information
- T1036: Masquerading

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (0)

- None linked in public reporting.

### 10. Looking around (1)

- T1083: File and Directory Discovery

### 11. Spreading (2)

- T1091: Replication Through Removable Media
- T1570: Lateral Tool Transfer

### 12. Gathering data (0)

- None linked in public reporting.

### 13. Keeping contact (0)

- None linked in public reporting.

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (0)

- None linked in public reporting.

## Who does Aoqin Dragon go after?

**Sectors:** Government, Education, Telecommunications

**Countries and victims named:** Australia, Cambodia, Hong Kong, Singapore, Vietnam

See threats by industry: https://www.precursorintelligence.com/industries

## Public reports about Aoqin Dragon

- https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/
- https://khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf

## Frequently asked questions

### Who is Aoqin Dragon?

Aoqin Dragon is a threat group thought to operate from China. Public reporting links it to 9 attack techniques, and to attacks on government, education and telecommunications organisations, with 5 countries and victims named.

### Where is Aoqin Dragon thought to be based?

Public reporting places Aoqin Dragon as operating from China. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### Who does Aoqin Dragon target?

In public reporting, sectors named include government, education and telecommunications, and 5 countries and victims are named, including Australia, Cambodia, Hong Kong and Singapore.

### How does Aoqin Dragon attack?

Public reporting links Aoqin Dragon to 9 attack techniques. Most of them are about preparation, running code and hiding.

### How do I know if Aoqin Dragon is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact