Loading story…
The DragonOK espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including PlugX variants, Sysget, IsSpace, and TidePool. Researchers tied a PlugX variant known as PIPX to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia.
The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting CVE-2015-1641, alongside techniques such as DLL sideloading, code injection into nslookup.exe, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as HKLM\SOFTWARE\BINARY or HKCU\SOFTWARE\BINARY instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
The LAC analysts confirmed Sysget use again in a targeted attack in late November 2017 and assessed the sample as a Sysget v4 variant.
A campaign observed around October 2017 used the files mcoemcpy.exe, mcutil.dll, and either Mlog.dat or mcafee.res to run the PIPX malware chain.
Analysts observed multiple targeted attacks from around October 2017 using the PIPX PlugX variant, delivered in RAR self-extracting archives and executed through DLL sideloading and code injection into nslookup.exe.
The LAC report says DragonOK's activity targeting Japan became more noticeable again from late October 2017, indicating a renewed wave of operations.
JPCERT/CC had previously reported a PlugX sample that used Poison Ivy API hash code, a detail later referenced in the LAC analysis of related malware activity.
A PIPX PlugX variant was observed around April 2016 using the files RasTls.exe, RasTls.dll, and RasTls.dll.msc as part of its execution chain.
A September 2015 report analyzed a new variant of the NfLog RAT, also known as IsSpace, and attributed its use to SAMURAI PANDA. The malware was reportedly deployed using a repurposed Hacking Team Adobe Flash exploit for CVE-2015-5122 and proxied C2 traffic through Google App Engine.
Unit 42 identified five phishing attacks conducted between January and March 2015 against Japanese organizations, primarily a manufacturing firm and later a high-tech organization, and attributed the activity to DragonOK. The campaign used Sysget/HelloBridge as a first-stage payload and revealed a newly identified custom backdoor, FormerFirstRAT, alongside other DragonOK-associated tools.
The LAC report states that the Sysget malware family, associated with DragonOK, had been used in targeted attacks in Japan since at least 2014.
LAC assessed that the PIPX PlugX variant was strongly linked to DragonOK based on overlapping infrastructure, registrant data, and ties to domains and malware families such as Aveo and Sysget.
Unit 42 attributed multiple recent attacks to DragonOK and reported the group was delivering updated Sysget variants, along with IsSpace and TidePool, via phishing emails and malicious RTF documents exploiting CVE-2015-1641. Japan was the primary target, with likely additional targeting in Taiwan, Tibet, and Russia.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
lac.co.jp
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.paloaltonetworks.com
Open sourcewikileaks.org
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026