A newly identified Chinese state-sponsored threat group known as Aoqin Dragon has been caught conducting cyber-espionage campaigns. After extensively tracking the threat actor, researchers from SentinelLabs uncovered a cluster of covert malicious activity going at least as far back as 2013. These threat actors primarily target entities throughout Southeastern Asia and Australia, including Cambodia, Vietnam, Singapore, and Hong Kong. Attack vectors that Aoqin Dragon threat actors used in their campaigns start with social engineering, launching phishing campaigns loaded with malicious Microsoft office documents. Based on historical attacks linked to Aoqin Dragon, the malicious payload would drop either a Mongall backdoor or a customized version of the open-source project Heyoka. During the first few years of this campaign, threat actors exploited vulnerabilities CVE-2012-0158 (Microsoft Office) and CVE-2010-3333 (Microsoft Office) to plant their malware on the user’s system. The phishing campaigns were often themed around either the disappearance of Malaysia Airlines Flight MH370, APAC political affairs, or pornographic content to entice users to execute the malicious documents. To evade detection post-compromise, Aoqin Dragon actors utilized DLL hijacking, Themida-packed files, and DNS tunneling. CTIX analysts continue to urge users to validate the integrity of all emails prior to downloading any attachments to lessen the chance for threat actor compromise.