Vulnerabilityhigh
DragonOK Updates Toolset and Targets Multiple Geographic Regions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1641 | Memory Corruption RCE in Microsoft Office via Malicious RTF Files | — | 97% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 78host.com | ved, the following domains were observed for their C2: kr44.78host[.]com gtoimage[.]com gogolekr[.]com All of the above domains ha |
| domain | dppline.org | The IsSpace samples resolved to the following domains: www.dppline[.]org www.matrens[.]top These domains had no apparent connectio |
| domain | gogolekr.com | ere observed for their C2: kr44.78host[.]com gtoimage[.]com gogolekr[.]com All of the above domains have Chinese WHOIS registrant de |
| domain | gotoimage.com | ns have Chinese WHOIS registrant details. Additionally, the gotoimage[.]com and trend.gogolekr[.]com are both registered to the same |
| domain | gtoimage.com | owing domains were observed for their C2: kr44.78host[.]com gtoimage[.]com gogolekr[.]com All of the above domains have Chinese WHOI |
| domain | matrens.top | es resolved to the following domains: www.dppline[.]org www.matrens[.]top These domains had no apparent connections to the previous |
| domain | skywave.top | C2 servers: europe.wikaba[.]com russiaboy.ssl443[.]org cool.skywave[.]top These domains did not have many definitive relations with |
| domain | ssl443.org | ith the following C2 servers: europe.wikaba[.]com russiaboy.ssl443[.]org cool.skywave[.]top These domains did not have many defini |
| domain | wikaba.com | entified communicated with the following C2 servers: europe.wikaba[.]com russiaboy.ssl443[.]org cool.skywave[.]top These domains d |
| md5 | 1420efbd80ce02328663631c8d8f813c | e sample. 1 2 3 4 5 6 GET / index . php ? type = read &id = 1420efbd80ce02328663631c8d8f813c &pageinfo = jp &lang = utf - 8 HTTP / 1.1 Connection : Keep |
From the original article
14 min read at unit42.paloaltonetworks.com
The DragonOK group has been actively launching attacks for years. We first discussed them in April 2015 when we witnessed them targeting a number of organizations in Japan . In recent months, Unit 42 has observed a number of attacks that we attribute to this group.
By Josh Grunzweig · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.