Threat Actor
DragonOK
Also known as: DragonOK
DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT.
2
Software
0
indicators on this record
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T12:34:03+00:00
- Type
- intrusion-set
Software & Tools (2)
▸
PlugX [malware]
PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita
▸
PoisonIvy [malware]
PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison
Explore this actor's full graph with Ninja Signal