Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years
sentinelone.com · Undated · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
3 CVEs- CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution15 reports>99.9%Top 0.02%89.2priority
- CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by CompromiseT1203Exploitation for Client Execution5 reports94.9%Top 0.14%89.1priority
- CVE-2010-3333Microsoft Office Stack-based Buffer Overflow VulnerabilityMicrosoft · OfficeKEVPublic exploitHigh · 7.8T1203Exploitation for Client ExecutionT1204.002Malicious File5 reports89.4%Top 0.22%78.4priority
Where it names them
CVE-2012-0158 Original (opens in a new tab) ↗
During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.
CVE-2014-6332 Original (opens in a new tab) ↗
In addition, they were also aware that another malicious script had been injected into the same website in November 2014, leveraging CVE-2014-6332 to download a trojan horse to the target’s host.
CVE-2010-3333 Original (opens in a new tab) ↗
During 2012 to 2015, Aoqin Dragon relied heavily on CVE-2012-0158 and CVE-2010-3333 to compromise their targets.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.