Trusted Design

Aoqin Dragon

アクターID: G1007

· MITRE Pageへのリンク

脅威アクターの詳細

Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.(Citation: SentinelOne Aoqin Dragon June 2022)

脅威アクターの別名・別称

Aoqin Dragon

利用した攻撃手法

• T1606.002 - SAML Tokens
• T1087.002 - Domain Account
• T1058 - Service Registry Permissions Weakness
• T1558 - Steal or Forge Kerberos Tickets
• T1219.001 - IDE Tunneling
• T1199 - Trusted Relationship
• T1218.010 - Regsvr32
• T1566.004 - Spearphishing Voice
• T1537 - Transfer Data to Cloud Account

関連するCVE (攻撃手法に関連)

• CVE-2015-3043 (T1218.010)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1219.001)
• CVE-2015-2852 (T1218.010)
• CVE-2015-2854 (T1218.010)
• CVE-2015-2853 (T1218.010)
• CVE-2016-1287 (T1606.002)
• CVE-2016-1562 (T1606.002)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2465 (T1219.001)
• CVE-2013-7331 (T1219.001)
• CVE-2016-4117 (T1218.010)
• CVE-2025-68645 (T1219.001)
• CVE-2014-4114 (T1218.010)
• CVE-2015-1770 (T1218.010)
• CVE-2015-2545 (T1219.001)
• CVE-2017-0199 (T1218.010)
• CVE-2012-0158 (T1218.010)
• CVE-2013-3906 (T1218.010)
• CVE-2014-6352 (T1218.010)
• CVE-2015-0016 (T1218.010)
• CVE-2010-3333 (T1218.010)
• CVE-2010-0188 (T1219.001)
• CVE-2010-2884 (T1219.001)
• CVE-2013-0640 (T1087.002)
• CVE-2011-0611 (T1218.010)
• CVE-2025-24893 (T1218.010)
• CVE-2015-5119 (T1218.010)
• CVE-2015-5122 (T1218.010)
• CVE-2012-1856 (T1218.010)
• CVE-2015-2546 (T1219.001)
• CVE-2014-6332 (T1218.010)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-3090 (T1218.010)
• CVE-2015-3113 (T1218.010)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2015-4495 (T1218.010)
• CVE-2015-2502 (T1218.010)
• CVE-2014-6271 (T1218.010)
• CVE-2014-4113 (T1219.001)
• CVE-2016-1010 (T1218.010)
• CVE-2016-1019 (T1219.001)
• CVE-2016-0984 (T1219.001)
• CVE-2016-1001 (T1218.010)
• CVE-2016-0998 (T1218.010)
• CVE-2015-1641 (T1219.001)
• CVE-2015-1701 (T1219.001)
• CVE-2015-0313 (T1218.010)
• CVE-2015-0359 (T1218.010)
• CVE-2014-0329 (T1219.001)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1218.010)
• CVE-2012-4969 (T1218.010)
• CVE-2015-6022 (T1219.001)
• CVE-2017-0263 (T1219.001)
• CVE-2017-0261 (T1219.001)
• CVE-2017-0262 (T1219.001)
• CVE-2025-55182 (T1219.001)
• CVE-2015-0311 (T1218.010)
• CVE-2010-3081 (T1219.001)
• CVE-2012-3213 (T1218.010)
• CVE-2012-4792 (T1218.010)
• CVE-2014-0322 (T1218.010)
• CVE-2012-1258 (T1219.001)
• CVE-2015-0336 (T1218.010)
• CVE-2011-3544 (T1219.001)
• CVE-2014-3153 (T1218.010)
• CVE-2014-4322 (T1219.001)
• CVE-2015-3636 (T1219.001)
• CVE-2013-6282 (T1219.001)
• CVE-2015-3105 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2017-16929 (T1219.001)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1218.010)
• CVE-2014-8439 (T1219.001)
• CVE-2013-2551 (T1218.010)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2014-1776 (T1218.010)
• CVE-2014-0556 (T1219.001)
• CVE-2012-1876 (T1218.010)
• CVE-2015-5560 (T1219.001)
• CVE-2015-0057 (T1219.001)
• CVE-2012-2539 (T1218.010)
• CVE-2015-0071 (T1218.010)
• CVE-2014-9163 (T1218.010)
• CVE-2012-1723 (T1219.001)
• CVE-2015-1761 (T1219.001)
• CVE-2014-8440 (T1219.001)
• CVE-2013-3660 (T1219.001)
• CVE-2010-0806 (T1218.010)
• CVE-2015-2360 (T1219.001)
• CVE-2014-4148 (T1219.001)
• CVE-2011-3402 (T1219.001)
• CVE-2014-6324 (T1219.001)
• CVE-2014-7247 (T1218.010)
• CVE-2013-2678 (T1219.001)
• CVE-2015-2426 (T1219.001)
• CVE-2008-1436 (T1219.001)
• CVE-2010-0232 (T1218.010)
• CVE-2010-4398 (T1219.001)
• CVE-2014-3393 (T1219.001)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1219.001)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1219.001)
• CVE-2009-3129 (T1219.001)
• CVE-2010-2572 (T1219.001)
• CVE-2011-1255 (T1218.010)
• CVE-2013-5990 (T1218.010)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1218.010)
• CVE-2015-2419 (T1218.010)
• CVE-2016-0189 (T1218.010)
• CVE-2017-0001 (T1219.001)
• CVE-2017-0143 (T1218.010)
• CVE-2023-1389 (T1219.001)
• CVE-2025-31125 (T1219.001)
• CVE-2025-34026 (T1218.010)
• CVE-2025-55183 (T1219.001)
• CVE-2025-55184 (T1219.001)
• CVE-2025-66478 (T1219.001)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1219.001)
• CVE-2015-7645 (T1218.010)
• CVE-2014-1761 (T1218.010)
• CVE-2015-7808 (T1218.010)
• CVE-2015-7755 (T1218.010)
• CVE-2015-8287 (T1218.010)
• CVE-2016-9495 (T1218.010)
• CVE-2014-8361 (T1218.010)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る