What tactics and techniques does Aoqin Dragon use?

How Aoqin Dragon Operates Across the Intrusion Chain

aoqin dragon’s tradecraft is best understood as a sequence rather than a single technique set. The group blends phishing, malicious document delivery, credential theft and malware deployment to get initial execution, then extends the intrusion with persistence, collection and covert command-and-control. That pattern matters because each stage creates the conditions for the next, and defenders need to break the chain early.

The early-stage activity is designed to look routine to users and mail filters. Phishing and document-based lures create a user-driven execution path, which is often more effective than purely technical exploitation because it relies on normal user behaviour and common file-handling habits.

Once a payload lands, the intrusion shifts from delivery to control. Backdoors and covert command-and-control give the operator a stable channel for follow-on tasks, while credential theft widens access beyond the original foothold. That combination usually indicates an actor trying to preserve access long enough to stage collection or additional tooling rather than burn the access immediately.

Initial Access, Execution, and Credential Theft

The most important feature of the initial phase is that it uses trusted-looking content to induce the victim to open or run something. Malicious documents, archive handling and other user-triggered execution paths are all common ways to start an intrusion without needing a direct exploit against the perimeter.

Credential theft is especially important in this pattern because it can convert a single endpoint compromise into broader access. Stolen credentials may be used to move into mailboxes, file shares, internal applications or remote access channels, depending on what the environment allows. That makes the credential theft step more than a side effect, it is often the bridge between malware execution and meaningful operational reach.

For defenders, the practical value is in correlating user activity with execution and authentication events. A suspicious document that launches a child process, followed by unusual sign-in behaviour or access from a new source, is often more informative than any one alert by itself.

Review Top 10 Phishing Techniques for the lure patterns that commonly underpin these intrusion chains.

Persistence, Command-and-Control, and Collection

After initial access, the group’s tactics shift toward durability and operational control. Persistence mechanisms such as startup locations or scheduled tasks help keep malware available after reboot or user logoff, while covert command-and-control channels let the operator issue instructions without obvious interactive access.

Collection is the natural downstream objective. Once the actor has stable access, the focus usually moves to identifying useful files, email, credentials or other data that can support later staging, exfiltration or follow-on abuse. The malware and backdoor components are therefore not just delivery mechanisms, they are the means by which the intruder stays present long enough to gather value.

That is why defenders should treat persistence indicators and outbound beaconing as linked signals. A new scheduled task alone may be benign, but a scheduled task that also produces periodic external traffic or follows a phishing-based execution event is a much stronger intrusion indicator.

Use MITRE ATT&CK Enterprise Matrix to map the observed sequence from initial access through persistence and command-and-control.

Risk and Threat Considerations

This tactic mix is risky because it combines human-targeted delivery with post-compromise control. If phishing succeeds and the payload establishes persistence, defenders may only see routine user activity while the operator maintains long-term access and quietly expands reach.

Failure mechanism: Trust in user-delivered content, coupled with weak execution controls and insufficient monitoring of persistence or beaconing, allows the intrusion to survive long enough for credentials and data to be taken.

Impact: The result can be broader account compromise, repeated re-entry after cleanup attempts, and collection of data or access material that supports later lateral movement or exfiltration.

Practitioner Guidance

What to verify: Check whether suspicious documents or archives were followed by child processes, new autoruns, scheduled tasks or unusual outbound connections. Those combinations matter more than a single file verdict.

What to prioritise: If credential theft is suspected, prioritise authentication review and session invalidation in parallel with endpoint containment. Waiting to confirm misuse before rotating exposed access increases blast radius.

Practitioner takeaway: The key judgement is to treat phishing, execution, persistence and beaconing as one intrusion path, not four separate problems, because the chain becomes far more dangerous once credentials or durable access are involved.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques does Night Dragon use?
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?