Aoqin Dragon
IntrusionSet · ATTACK:enterprise:G1007
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1007",
"title": "Aoqin Dragon",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1007",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--64d5f96a-f121-4d19-89f6-6709f5c49faa",
"external_id": "G1007",
"domain": "enterprise",
"created": "2022-07-14T14:32:47.582Z",
"modified": "2026-07-31T18:47:58.829Z",
"version": "1.0",
"aliases": [
"Aoqin Dragon"
],
"tactics": [
],
"source_references": [
{
"source_name": "SentinelOne Aoqin Dragon June 2022",
"url": "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c306018-7f22-4080-81c5-939bd0bd81be
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--287c3024-f58d-4fab-87a7-54d4b52f5a5c
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1091
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f337593-16b2-40a2-928c-c7659d0326ea
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f42c6bd-332d-40b0-9e5f-ead557d021c9
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:S1026
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4753b372-6ac2-4a0e-8e0c-1a14c884fa8e
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65656d55-1f2f-43f9-b29f-084b9024841c
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--767ce5fe-06f5-4efc-aa41-129fad867c65
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--945ebd48-f638-469c-a106-113ab8bbf408
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6ff725c-1c60-44dd-8f78-22f1b009bbb5
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0601ad4-5d8d-4c86-8d0a-86fc2edadbc3
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:S1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db7aadec-757b-49b3-8691-1f23b5c7c5fc
SentinelOne Aoqin Dragon June 2022