MITRE ATT&CKcampaign

C0002 Night Dragon

Published 2022-09-08 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2022-09-08

Description

Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.

Related

Uses · MITRE ATT&CK (34)

  • T1685 Disable or Modify Tools technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1608.001 Upload Malware sub-technique
  • T1583.004 Server sub-technique
  • T1584.004 Server sub-technique
  • T1588.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.002 Remote Data Staging sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1568 Dynamic Resolution technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1027.002 Software Packing sub-technique
  • T1550.002 Pass the Hash sub-technique
  • S0350 zwShell software (malware)
  • T1190 Exploit Public-Facing Application technique
  • T1219 Remote Access Tools technique
  • S0008 gsecdump software (tool)
  • S0029 PsExec software (tool)
  • S0073 ASPXSpy software (malware)
  • S0110 at software (tool)
  • T1005 Data from Local System technique
  • T1008 Fallback Channels technique
  • T1033 System Owner/User Discovery technique
  • T1078 Valid Accounts technique
Show all 34 ›

References