DragonOK G0017

Overview 15 indicators

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.

Software 2

• PoisonIvy
• PlugX

Principal sources 6 reports

Ranked by how many of this actor's indicators each report brought in.

• 7fireeye.com/content/dam/fireeye-www/global/en/curre…
• 5lac.co.jp/english/report/2018/01/23_alert_01.html
• 5app.any.run/tasks/ceb18346-8e01-4abe-89b9-97b44b14c…
• 2researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok…
• 2app.validin.com/detail?find=153.234.67.222&type=ip4&ref…
• 1morphick.com/resources/news/deep-dive-dragonok-rambo…

Timeline 15 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2024-11-30 1 domain2 yrs ago

   researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok… · app.validin.com/detail?find=153.234.67.222&type=ip4&ref…

   donkeyhaws.info

   copy batch

2. 2020-09-16 4 domain, 1 url_path6 yrs ago

   lac.co.jp/english/report/2018/01/23_alert_01.html · app.any.run/tasks/ceb18346-8e01-4abe-89b9-97b44b14c…

   domain	bbs.donkeyhaws.info
   domain	http.donkeyhaws.info
   domain	https.osakaintec.com
   domain	php.marbletemps.com
   url_path	/XpXpXp

   copy batch

3. 2018-05-11 7 domain8 yrs ago

   fireeye.com/content/dam/fireeye-www/global/en/curre…

   ghostale.com

   jpaols.com

   moafee.com

   ndbssh.com

   pktmedia.com

   skyppee.com

   ycbackap.com

   copy batch

4. 2018-05-11 1 domain8 yrs ago

   researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok… · app.validin.com/detail?find=153.234.67.222&type=ip4&ref…

   biosnews.info

   copy batch

5. 2017-04-13 1 domain9 yrs ago

   morphick.com/resources/news/deep-dive-dragonok-rambo…

   busserh.mancely.com

   copy batch

Further reading 9

• researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok…
• attack.mitre.org/groups/G0017
• web.archive.org/web/20210920193513/https://www.fireeye.…
• app.any.run/tasks/ceb18346-8e01-4abe-89b9-97b44b14c…
• app.validin.com/detail?find=153.234.67.222&type=ip4&ref…
• researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok…
• morphick.com/resources/news/deep-dive-dragonok-rambo…
• fireeye.com/content/dam/fireeye-www/global/en/curre…
• lac.co.jp/english/report/2018/01/23_alert_01.html