Techniques Used

Domain	ID	Name	Use
Enterprise	T1587	.001	Develop Capabilities: Malware	Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.[1]
Enterprise	T1203		Exploitation for Client Execution	Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.[1]
Enterprise	T1083		File and Directory Discovery	Aoqin Dragon has run scripts to identify file formats including Microsoft Word.[1]
Enterprise	T1570		Lateral Tool Transfer	Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.[1]
Enterprise	T1036	.005	Masquerading: Match Legitimate Name or Location	Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.[1]
Enterprise	T1027	.002	Obfuscated Files or Information: Software Packing	Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.[1]
Enterprise	T1588	.002	Obtain Capabilities: Tool	Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.[1]
Enterprise	T1091		Replication Through Removable Media	Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.[1]
Enterprise	T1204	.002	User Execution: Malicious File	Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.[1]

Software

ID	Name	References	Techniques
S1027	Heyoka Backdoor	[1]	Application Layer Protocol: DNS, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Deobfuscate/Decode Files or Information, File and Directory Discovery, Indicator Removal: File Deletion, Masquerading: Masquerade Task or Service, Obfuscated Files or Information, Peripheral Device Discovery, Process Discovery, Process Injection: Dynamic-link Library Injection, Protocol Tunneling, System Binary Proxy Execution: Rundll32, System Information Discovery, System Service Discovery, User Execution: Malicious File
S1026	Mongall	[1]	Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Data Encoding: Standard Encoding, Data from Local System, Deobfuscate/Decode Files or Information, Encrypted Channel: Symmetric Cryptography, Exfiltration Over C2 Channel, Ingress Tool Transfer, Obfuscated Files or Information: Software Packing, Peripheral Device Discovery, Process Injection: Dynamic-link Library Injection, System Binary Proxy Execution: Rundll32, System Information Discovery, User Execution: Malicious File

None

Aoqin Dragon is a highly sophisticated threat actor that has been active since 2013 and has primarily targeted government, education, and telecommunication organizations in Southeast Asia and Australia. Despite its relatively low profile, Aoqin Dragon has been responsible for several high-impact breaches, making it a serious concern for organizations operating in the region. In this blog post, we will take a closer look at the tactics, techniques, and procedures (TTPs) used by Aoqin Dragon, and what organizations can do to defend against its attacks.