CyberStack

MITRE ATT&CK / Groups / G0017

DragonOK

ID
G0017
Source
attack.mitre.org
MITRE last modified
1 Aug 2026

DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. [1] It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. [2]

Software used (2)

References

  1. Operation Quantum Entanglement
  2. New DragonOK