Night Dragon

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2009-11-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2009-11-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2011-02-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Night Dragon, threat actors used domain accounts to gain further access to victim systems.(Citation: McAfee Night Dragon)

• T1608.001 · Upload Malware

  Resource Development — During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.(Citation: McAfee Night Dragon)

• T1588.001 · Malware

  Resource Development — During Night Dragon, threat actors used Trojans from underground hacker websites.(Citation: McAfee Night Dragon)

• T1566.002 · Spearphishing Link

  Initial Access — During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.(Citation: McAfee Night Dragon)

• T1204.001 · Malicious Link

  Execution — During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.(Citation: McAfee Night Dragon)

• T1133 · External Remote Services

  Persistence, Initial Access — During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.(Citation: McAfee Night Dragon)

• T1005 · Data from Local System

  Collection — During Night Dragon, the threat actors collected files and other data from compromised systems.(Citation: McAfee Night Dragon)

• T1059.003 · Windows Command Shell

  Execution — During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.(Citation: McAfee Night Dragon)

• T1027.002 · Software Packing

  Stealth — During Night Dragon, threat actors used software packing in its tools.(Citation: McAfee Night Dragon)

• T1190 · Exploit Public-Facing Application

  Initial Access — During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.(Citation: McAfee Night Dragon)

• T1078 · Valid Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.(Citation: McAfee Night Dragon)

• T1027.013 · Encrypted/Encoded File

  Stealth — During Night Dragon, threat actors used a DLL that included an XOR-encoded section.(Citation: McAfee Night Dragon)

• T1033 · System Owner/User Discovery

  Discovery — During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.(Citation: McAfee Night Dragon)

• T1588.002 · Tool

  Resource Development — During Night Dragon, threat actors obtained and used tools such as gsecdump.(Citation: McAfee Night Dragon)

• T1112 · Modify Registry

  Defense Impairment, Persistence — During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.(Citation: McAfee Night Dragon)

• T1003.002 · Security Account Manager

  Credential Access — During Night Dragon, threat actors dumped account hashes using gsecdump.(Citation: McAfee Night Dragon)

• T1071.001 · Web Protocols

  Command And Control — During Night Dragon, threat actors used HTTP for C2.(Citation: McAfee Night Dragon)

• T1114.001 · Local Email Collection

  Collection — During Night Dragon, threat actors used RAT malware to exfiltrate email archives.(Citation: McAfee Night Dragon)

• T1008 · Fallback Channels

  Command And Control — During Night Dragon, threat actors used company extranet servers as secondary C2 servers.(Citation: McAfee Night Dragon)

• T1685 · Disable or Modify Tools

  Defense Impairment — During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.(Citation: McAfee Night Dragon)

• T1083 · File and Directory Discovery

  Discovery — During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.(Citation: McAfee Night Dragon)

• T1583.004 · Server

  Resource Development — During Night Dragon, threat actors purchased hosted services to use for C2.(Citation: McAfee Night Dragon)

• T1550.002 · Pass the Hash

  Lateral Movement — During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.(Citation: McAfee Night Dragon)

• T1219 · Remote Access Tools

  Command And Control — During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.(Citation: McAfee Night Dragon)

• T1110.002 · Password Cracking

  Credential Access — During Night Dragon, threat actors used Cain & Abel to crack password hashes.(Citation: McAfee Night Dragon)

• T1584.004 · Server

  Resource Development — During Night Dragon, threat actors compromised web servers to use for C2.(Citation: McAfee Night Dragon)

• T1568 · Dynamic Resolution

  Command And Control — During Night Dragon, threat actors used dynamic DNS services for C2.(Citation: McAfee Night Dragon)

• T1105 · Ingress Tool Transfer

  Command And Control — During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.(Citation: McAfee Night Dragon)

• T1074.002 · Remote Data Staging

  Collection — During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.(Citation: McAfee Night Dragon)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0002

  Official MITRE ATT&CK campaign record C0002. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.