{
  "aliases": [
    "Heyoka",
    "Mongall",
    "UNC94"
  ],
  "attack_id": "G1007",
  "attack_name": "Aoqin Dragon",
  "attack_url": "https://attack.mitre.org/groups/G1007/",
  "counts": {
    "domain": 107,
    "ipv4": 4,
    "url": 3,
    "url_path": 1
  },
  "first_seen": {
    "domain": {
      "adsoft.name": "2022-06-09",
      "back.satunusa.org": "2022-06-09",
      "baomoi.vnptnet.info": "2022-06-09",
      "bbw.fushing.org": "2022-06-09",
      "bca.zdungk.com": "2022-06-09",
      "bkav.manlish.net": "2022-06-09",
      "bkav.welikejack.com": "2022-06-09",
      "bkavonline.vnptnet.info": "2022-06-09",
      "bluesky1234.com": "2022-06-09",
      "bush2015.net": "2022-06-09",
      "cl.weststations.com": "2022-06-09",
      "cloundvietnam.com": "2022-06-09",
      "comnnet.net": "2022-06-09",
      "cpt.vnptnet.inf": "2022-06-09",
      "cvb.hotcup.pw": "2022-06-09",
      "dellyou.com": "2022-06-09",
      "dinhk.net": "2022-06-09",
      "dns.foodforthought1.com": "2022-06-09",
      "dns.lioncity.top": "2022-06-09",
      "dns.satunusa.org": "2022-06-09",
      "dns.zdungk.com": "2022-06-09",
      "ds.vdcvn.com": "2022-06-09",
      "ds.xrayccc.top": "2022-06-09",
      "dungk.com": "2022-06-09",
      "facebookmap.top": "2022-06-09",
      "fbcl2.adsoft.name": "2022-06-09",
      "fbcl2.softad.net": "2022-06-09",
      "flower2.yyppmm.com": "2022-06-09",
      "followag.org": "2022-06-09",
      "foodforthought1.com": "2022-06-09",
      "fushing.org": "2022-06-09",
      "game.vietnamflash.com": "2022-06-09",
      "hello.bluesky1234.com": "2022-06-09",
      "hotcup.pw": "2022-06-09",
      "ipad.vnptnet.info": "2022-06-09",
      "ks.manlish.net": "2022-06-09",
      "lepad.fushing.org": "2022-06-09",
      "lllyyy.adsoft.name": "2022-06-09",
      "longvn.net": "2022-06-09",
      "lucky.manlish.net": "2022-06-09",
      "ma550.adsoft.name": "2022-06-09",
      "ma550.softad.net": "2022-06-09",
      "mail.comnnet.net": "2022-06-09",
      "mail.tiger1234.com": "2022-06-09",
      "mail.vdcvn.com": "2022-06-09",
      "manlish.net": "2022-06-09",
      "mass.longvn.net": "2022-06-09",
      "mcafee.bluesky1234.com": "2022-06-09",
      "media.vietnamflash.com": "2022-06-09",
      "mil.dungk.com": "2022-06-09",
      "mil.zdungk.com": "2022-06-09",
      "missyou.longvn.net": "2022-06-09",
      "mmchj2.telorg.net": "2022-06-09",
      "mmslsh.tiger1234.com": "2022-06-09",
      "mobile.vdcvn.com": "2022-06-09",
      "moit.longvn.net": "2022-06-09",
      "movie.vdcvn.com": "2022-06-09",
      "neverdropd.com": "2022-06-09",
      "news.philstar2.com": "2022-06-09",
      "news.welikejack.com": "2022-06-09",
      "npt.vnptnet.info": "2022-06-09",
      "ns.fushing.org": "2022-06-09",
      "nycl.neverdropd.com": "2022-06-09",
      "phcl.followag.org": "2022-06-09",
      "phcl.neverdropd.com": "2022-06-09",
      "philstar2.com": "2022-06-09",
      "phung123.com": "2022-06-09",
      "pna.adsoft.name": "2022-06-09",
      "pnavy3.neverdropd.com": "2022-06-09",
      "satunusa.org": "2024-11-30",
      "sky.bush2015.net": "2022-06-09",
      "sky.vietnamflash.com": "2022-06-09",
      "soap.free.cloudns.asia": "2024-02-14",
      "softad.net": "2022-06-09",
      "tcv.tiger1234.com": "2022-06-09",
      "telecom.longvn.net": "2022-06-09",
      "telecom.manlish.net": "2022-06-09",
      "telorg.net": "2022-06-09",
      "test.facebookmap.top": "2022-06-09",
      "th-y3.adsoft.name": "2022-06-09",
      "th550.adsoft.name": "2022-06-09",
      "th550.softad.net": "2022-06-09",
      "three.welikejack.com": "2022-06-09",
      "thy3.softad.net": "2022-06-09",
      "tiger1234.com": "2022-06-09",
      "trend.welikejack.com": "2022-06-09",
      "vdcvn.com": "2022-06-09",
      "video.philstar2.com": "2022-06-09",
      "viet.vnptnet.info": "2022-06-09",
      "viet.zdungk.com": "2022-06-09",
      "vietnam.vnptnet.info": "2022-06-09",
      "vietnamflash.com": "2022-06-09",
      "vnet.fushing.org": "2022-06-09",
      "vnn.bush2015.net": "2022-06-09",
      "vnn.phung123.com": "2022-06-09",
      "vnptnet.info": "2022-06-09",
      "webmail.philstar2.com": "2022-06-09",
      "welikejack.com": "2022-06-09",
      "yok.fushing.org": "2022-06-09",
      "yote.dellyou.com": "2022-06-09",
      "yyppmm.com": "2022-06-09",
      "zdungk.com": "2022-06-09",
      "zing.vietnamflash.com": "2022-06-09",
      "zingme.dungk.com": "2022-06-09",
      "zingme.longvn.net": "2022-06-09",
      "zw.dinhk.net": "2022-06-09",
      "zw.phung123.com": "2022-06-09"
    },
    "ipv4": {
      "64.27.4.157:53": "2022-06-09",
      "64.27.4.157:8080": "2022-06-09",
      "67.210.114.99:443": "2022-06-09",
      "67.210.114.99:8080": "2022-06-09"
    },
    "url": {
      "http://64.27.4.157": "2022-06-09",
      "http://64.27.4.19": "2022-06-09",
      "http://67.210.114.99": "2022-06-09"
    },
    "url_path": {
      "/rrd9cutaenieyb9hro6v_qgo2fvjgablyrklaqvbgwr1swjo": "2024-02-14"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2022-06-09",
    "latest": "2024-11-30"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "adsoft.name",
      "back.satunusa.org",
      "baomoi.vnptnet.info",
      "bbw.fushing.org",
      "bca.zdungk.com",
      "bkav.manlish.net",
      "bkav.welikejack.com",
      "bkavonline.vnptnet.info",
      "bluesky1234.com",
      "bush2015.net",
      "cl.weststations.com",
      "cloundvietnam.com",
      "comnnet.net",
      "cpt.vnptnet.inf",
      "cvb.hotcup.pw",
      "dellyou.com",
      "dinhk.net",
      "dns.foodforthought1.com",
      "dns.lioncity.top",
      "dns.satunusa.org",
      "dns.zdungk.com",
      "ds.vdcvn.com",
      "ds.xrayccc.top",
      "dungk.com",
      "facebookmap.top",
      "fbcl2.adsoft.name",
      "fbcl2.softad.net",
      "flower2.yyppmm.com",
      "followag.org",
      "foodforthought1.com",
      "fushing.org",
      "game.vietnamflash.com",
      "hello.bluesky1234.com",
      "hotcup.pw",
      "ipad.vnptnet.info",
      "ks.manlish.net",
      "lepad.fushing.org",
      "lllyyy.adsoft.name",
      "longvn.net",
      "lucky.manlish.net",
      "ma550.adsoft.name",
      "ma550.softad.net",
      "mail.comnnet.net",
      "mail.tiger1234.com",
      "mail.vdcvn.com",
      "manlish.net",
      "mass.longvn.net",
      "mcafee.bluesky1234.com",
      "media.vietnamflash.com",
      "mil.dungk.com",
      "mil.zdungk.com",
      "missyou.longvn.net",
      "mmchj2.telorg.net",
      "mmslsh.tiger1234.com",
      "mobile.vdcvn.com",
      "moit.longvn.net",
      "movie.vdcvn.com",
      "neverdropd.com",
      "news.philstar2.com",
      "news.welikejack.com",
      "npt.vnptnet.info",
      "ns.fushing.org",
      "nycl.neverdropd.com",
      "phcl.followag.org",
      "phcl.neverdropd.com",
      "philstar2.com",
      "phung123.com",
      "pna.adsoft.name",
      "pnavy3.neverdropd.com",
      "satunusa.org",
      "sky.bush2015.net",
      "sky.vietnamflash.com",
      "soap.free.cloudns.asia",
      "softad.net",
      "tcv.tiger1234.com",
      "telecom.longvn.net",
      "telecom.manlish.net",
      "telorg.net",
      "test.facebookmap.top",
      "th-y3.adsoft.name",
      "th550.adsoft.name",
      "th550.softad.net",
      "three.welikejack.com",
      "thy3.softad.net",
      "tiger1234.com",
      "trend.welikejack.com",
      "vdcvn.com",
      "video.philstar2.com",
      "viet.vnptnet.info",
      "viet.zdungk.com",
      "vietnam.vnptnet.info",
      "vietnamflash.com",
      "vnet.fushing.org",
      "vnn.bush2015.net",
      "vnn.phung123.com",
      "vnptnet.info",
      "webmail.philstar2.com",
      "welikejack.com",
      "yok.fushing.org",
      "yote.dellyou.com",
      "yyppmm.com",
      "zdungk.com",
      "zing.vietnamflash.com",
      "zingme.dungk.com",
      "zingme.longvn.net",
      "zw.dinhk.net",
      "zw.phung123.com"
    ],
    "ipv4": [
      "64.27.4.157:53",
      "64.27.4.157:8080",
      "67.210.114.99:443",
      "67.210.114.99:8080"
    ],
    "url": [
      "http://64.27.4.157",
      "http://64.27.4.19",
      "http://67.210.114.99"
    ],
    "url_path": [
      "/rrd9cutaenieyb9hro6v_qgo2fvjgablyrklaqvbgwr1swjo"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "AOQINDRAGON"
  ],
  "references": [
    "https://twitter.com/AndreGironda/status/1757929271962550534",
    "https://twitter.com/alex_lanstein/status/1757855436261245194",
    "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/",
    "https://www.virustotal.com/gui/file/2110627fc40daaa7903210e310ee0f9ee8b79f47b6188431eb67b5f94e03a139/detection",
    "https://www.virustotal.com/gui/file/313355f5ecf62401247c61e147b43f74eb7fcbfdf4856c7270079265cac07026/detection",
    "https://www.virustotal.com/gui/file/4d082fbd76b9f8f83e29ea8fe5d2355558584e9dfb3b60b855537c786e8552e7/detection",
    "https://www.virustotal.com/gui/file/73125d33e358395f067849497b1694e81f0a23795bc9029ac1632ebb70f07338/detection",
    "https://www.virustotal.com/gui/file/7e31a7da7322546220f74b3f0556467cc1c2c41846dd9d31f4e942128b3a894f/detection",
    "https://www.virustotal.com/gui/file/908bdcb18265b0a3d93e7070d093050a028099a0af261ff0250a0b44a23cd3fe/detection",
    "https://www.virustotal.com/gui/file/9211a584ce32883437fba00adaa8df462683daad165bd740e43f2a4d6022b9a4/detection",
    "https://www.virustotal.com/gui/file/929eefaafc3906ae27371366addb838fba597091ab684a80117da97378164d73/detection",
    "https://www.virustotal.com/gui/file/bec277998b7780eb67dc6f436282652ca3f34a812a2555c8bfee87a5b890b2e7/detection",
    "https://www.virustotal.com/gui/file/c57bc203dca9dfd24cad72bee445b3dabdcc7cad6dc30640033335e32e833389/detection",
    "https://www.virustotal.com/gui/file/cc1f543cbb4930e045f49e681fd0a1cc7c9d27eb0a03208a75b6608fcecab3a4/detection",
    "https://www.virustotal.com/gui/file/d7d29522157423cd4ccaab42612f7db7ddf5670db9841dce02e438baea64d92e/detection",
    "https://www.virustotal.com/gui/ip-address/172.111.192.233/relations",
    "https://www.virustotal.com/gui/ip-address/210.209.118.165/relations",
    "https://www.virustotal.com/gui/ip-address/45.77.11.148/relations",
    "https://www.virustotal.com/gui/ip-address/59.188.234.233/relations"
  ],
  "related": [],
  "slug": "G1007",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-11-30",
      "indicators": {
        "domain": [
          "satunusa.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/",
        "https://www.virustotal.com/gui/ip-address/172.111.192.233/relations",
        "https://www.virustotal.com/gui/ip-address/210.209.118.165/relations",
        "https://www.virustotal.com/gui/ip-address/45.77.11.148/relations",
        "https://www.virustotal.com/gui/ip-address/59.188.234.233/relations",
        "https://www.virustotal.com/gui/file/c57bc203dca9dfd24cad72bee445b3dabdcc7cad6dc30640033335e32e833389/detection",
        "https://www.virustotal.com/gui/file/d7d29522157423cd4ccaab42612f7db7ddf5670db9841dce02e438baea64d92e/detection",
        "https://www.virustotal.com/gui/file/313355f5ecf62401247c61e147b43f74eb7fcbfdf4856c7270079265cac07026/detection",
        "https://www.virustotal.com/gui/file/908bdcb18265b0a3d93e7070d093050a028099a0af261ff0250a0b44a23cd3fe/detection",
        "https://www.virustotal.com/gui/file/9211a584ce32883437fba00adaa8df462683daad165bd740e43f2a4d6022b9a4/detection",
        "https://www.virustotal.com/gui/file/7e31a7da7322546220f74b3f0556467cc1c2c41846dd9d31f4e942128b3a894f/detection",
        "https://www.virustotal.com/gui/file/4d082fbd76b9f8f83e29ea8fe5d2355558584e9dfb3b60b855537c786e8552e7/detection",
        "https://www.virustotal.com/gui/file/2110627fc40daaa7903210e310ee0f9ee8b79f47b6188431eb67b5f94e03a139/detection",
        "https://www.virustotal.com/gui/file/73125d33e358395f067849497b1694e81f0a23795bc9029ac1632ebb70f07338/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2024-02-14",
      "indicators": {
        "domain": [
          "soap.free.cloudns.asia"
        ],
        "url_path": [
          "/rrd9cutaenieyb9hro6v_qgo2fvjgablyrklaqvbgwr1swjo"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/alex_lanstein/status/1757855436261245194",
        "https://twitter.com/AndreGironda/status/1757929271962550534",
        "https://www.virustotal.com/gui/file/cc1f543cbb4930e045f49e681fd0a1cc7c9d27eb0a03208a75b6608fcecab3a4/detection",
        "https://www.virustotal.com/gui/file/bec277998b7780eb67dc6f436282652ca3f34a812a2555c8bfee87a5b890b2e7/detection",
        "https://www.virustotal.com/gui/file/929eefaafc3906ae27371366addb838fba597091ab684a80117da97378164d73/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 105,
        "ipv4": 4,
        "url": 3
      },
      "first_seen": "2022-06-09",
      "indicators": {
        "domain": [
          "adsoft.name",
          "back.satunusa.org",
          "baomoi.vnptnet.info",
          "bbw.fushing.org",
          "bca.zdungk.com",
          "bkav.manlish.net",
          "bkav.welikejack.com",
          "bkavonline.vnptnet.info",
          "bluesky1234.com",
          "bush2015.net",
          "cl.weststations.com",
          "cloundvietnam.com",
          "comnnet.net",
          "cpt.vnptnet.inf",
          "cvb.hotcup.pw",
          "dellyou.com",
          "dinhk.net",
          "dns.foodforthought1.com",
          "dns.lioncity.top",
          "dns.satunusa.org",
          "dns.zdungk.com",
          "ds.vdcvn.com",
          "ds.xrayccc.top",
          "dungk.com",
          "facebookmap.top",
          "fbcl2.adsoft.name",
          "fbcl2.softad.net",
          "flower2.yyppmm.com",
          "followag.org",
          "foodforthought1.com",
          "fushing.org",
          "game.vietnamflash.com",
          "hello.bluesky1234.com",
          "hotcup.pw",
          "ipad.vnptnet.info",
          "ks.manlish.net",
          "lepad.fushing.org",
          "lllyyy.adsoft.name",
          "longvn.net",
          "lucky.manlish.net",
          "ma550.adsoft.name",
          "ma550.softad.net",
          "mail.comnnet.net",
          "mail.tiger1234.com",
          "mail.vdcvn.com",
          "manlish.net",
          "mass.longvn.net",
          "mcafee.bluesky1234.com",
          "media.vietnamflash.com",
          "mil.dungk.com",
          "mil.zdungk.com",
          "missyou.longvn.net",
          "mmchj2.telorg.net",
          "mmslsh.tiger1234.com",
          "mobile.vdcvn.com",
          "moit.longvn.net",
          "movie.vdcvn.com",
          "neverdropd.com",
          "news.philstar2.com",
          "news.welikejack.com",
          "npt.vnptnet.info",
          "ns.fushing.org",
          "nycl.neverdropd.com",
          "phcl.followag.org",
          "phcl.neverdropd.com",
          "philstar2.com",
          "phung123.com",
          "pna.adsoft.name",
          "pnavy3.neverdropd.com",
          "sky.bush2015.net",
          "sky.vietnamflash.com",
          "softad.net",
          "tcv.tiger1234.com",
          "telecom.longvn.net",
          "telecom.manlish.net",
          "telorg.net",
          "test.facebookmap.top",
          "th-y3.adsoft.name",
          "th550.adsoft.name",
          "th550.softad.net",
          "three.welikejack.com",
          "thy3.softad.net",
          "tiger1234.com",
          "trend.welikejack.com",
          "vdcvn.com",
          "video.philstar2.com",
          "viet.vnptnet.info",
          "viet.zdungk.com",
          "vietnam.vnptnet.info",
          "vietnamflash.com",
          "vnet.fushing.org",
          "vnn.bush2015.net",
          "vnn.phung123.com",
          "vnptnet.info",
          "webmail.philstar2.com",
          "welikejack.com",
          "yok.fushing.org",
          "yote.dellyou.com",
          "yyppmm.com",
          "zdungk.com",
          "zing.vietnamflash.com",
          "zingme.dungk.com",
          "zingme.longvn.net",
          "zw.dinhk.net",
          "zw.phung123.com"
        ],
        "ipv4": [
          "64.27.4.157:53",
          "64.27.4.157:8080",
          "67.210.114.99:443",
          "67.210.114.99:8080"
        ],
        "url": [
          "http://64.27.4.157",
          "http://64.27.4.19",
          "http://67.210.114.99"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/",
        "https://www.virustotal.com/gui/ip-address/172.111.192.233/relations",
        "https://www.virustotal.com/gui/ip-address/210.209.118.165/relations",
        "https://www.virustotal.com/gui/ip-address/45.77.11.148/relations",
        "https://www.virustotal.com/gui/ip-address/59.188.234.233/relations",
        "https://www.virustotal.com/gui/file/c57bc203dca9dfd24cad72bee445b3dabdcc7cad6dc30640033335e32e833389/detection",
        "https://www.virustotal.com/gui/file/d7d29522157423cd4ccaab42612f7db7ddf5670db9841dce02e438baea64d92e/detection",
        "https://www.virustotal.com/gui/file/313355f5ecf62401247c61e147b43f74eb7fcbfdf4856c7270079265cac07026/detection",
        "https://www.virustotal.com/gui/file/908bdcb18265b0a3d93e7070d093050a028099a0af261ff0250a0b44a23cd3fe/detection",
        "https://www.virustotal.com/gui/file/9211a584ce32883437fba00adaa8df462683daad165bd740e43f2a4d6022b9a4/detection",
        "https://www.virustotal.com/gui/file/7e31a7da7322546220f74b3f0556467cc1c2c41846dd9d31f4e942128b3a894f/detection",
        "https://www.virustotal.com/gui/file/4d082fbd76b9f8f83e29ea8fe5d2355558584e9dfb3b60b855537c786e8552e7/detection",
        "https://www.virustotal.com/gui/file/2110627fc40daaa7903210e310ee0f9ee8b79f47b6188431eb67b5f94e03a139/detection",
        "https://www.virustotal.com/gui/file/73125d33e358395f067849497b1694e81f0a23795bc9029ac1632ebb70f07338/detection"
      ],
      "total": 112
    }
  ]
}