Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.1
- SentinelOne Aoqin Dragon June 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Aoqin Dragon | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2022 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1027.002 | Software Packing | — |
| T1036 | Masquerading | — |
| T1083 | File and Directory Discovery | — |
| T1091 | Replication Through Removable Media | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1570 | Lateral Tool Transfer | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
Aliases
Aoqin Dragon
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.