CVE Intelligence
Home / Threat actors / Aoqin Dragon

Aoqin Dragon G1007

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
10
Techniques
2
Malware and tools

Aoqin Dragon is a suspected Chinese cyber espionage threat group that has been active since at least 2013. Aoqin Dragon has primarily targeted government, education, and telecommunication organizations in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. Security researchers noted a potential association between Aoqin Dragon and UNC94, based on malware, infrastructure, and targets.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2012-0158 High · 8.8 KEV Ransomware Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
“Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.”
CVE-2010-3333 High · 7.8 KEV Microsoft Office Stack-based Buffer Overflow Vulnerability
“Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.”

Techniques by tactic

Resource Development
T1587.001 MalwareT1588.002 Tool
Initial Access
T1091 Replication Through Removable Media
Execution
T1203 Exploitation for Client ExecutionT1204.002 Malicious File
Stealth
T1027.002 Software PackingT1036 Masquerading
Discovery
T1083 File and Directory Discovery
Lateral Movement
T1091 Replication Through Removable MediaT1570 Lateral Tool Transfer

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.