Aoqin Dragon

Overview

Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.

Naming & attribution

Aoqin Dragon is tracked under 1 names across the industry. It uses 9 documented ATT&CK techniques — more than 26% of the 174 groups tracked here. Activity attributed since at least 2013.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• The White Company — 3 shared techniques (23% overlap)
• Elderwood China — 3 shared techniques (20% overlap)
• admin@338 China — 3 shared techniques (17% overlap)
• Dark Caracal — 3 shared techniques (17% overlap)
• Inception Russia — 4 shared techniques (15% overlap)
• BlackTech China — 3 shared techniques (15% overlap)

Targets

Education · Government · Telecommunications

Regions

Australia · Cambodia · Hong Kong · Singapore · Vietnam

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 9 techniques across 5 tactics

Tools & malware (2)

Mongall · Heyoka Backdoor

Reporting (1)

• Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years — Chen, Joey