A previously undocumented Chinese-speaking advanced persistent threat (APT) actor dubbed Aoqin Dragon has been linked to a string of espionage-oriented attacks aimed at government, education, and telecom entities chiefly in Southeast Asia and Australia dating as far back as 2013.
“Aoqin Dragon seeks initial access primarily through document exploits and the use of fake removable devices,” SentinelOne researcher Joey Chen said in a report shared with The Hacker News. “Other techniques the attacker has been observed using include DLL hijacking, Themida-packed files, and DNS tunneling to evade post-compromise detection.”
