Sharp Dragon | |
Other Names | Sharp Panda Panda Panda Dragon |
Location | China |
Date of initial activity | 2021 |
Suspected Attribution | Cybercriminal |
Government Affiliation | No |
Motivation | Cyberespionage |
Associated Tools | VictoryDLL |
Overview
Governmental Organizations
Diplomatic Entities
Infrastructure
High-Profile Organizations
Attack vectors
Phishing Emails
Malicious Documents
Compromised Infrastructure
Remote Template Exploitation
Exploited Vulnerabilities
How they operate
At the heart of Sharp Dragon’s tactics is their use of phishing emails. These emails are meticulously crafted to appear as legitimate communications, often involving high-profile or sensitive topics relevant to the target’s interests. The phishing campaigns are usually accompanied by malicious attachments or links, designed to exploit vulnerabilities in the victim’s system. Once a recipient interacts with the phishing content, the group deploys various malware payloads, including custom tools and popular frameworks like Cobalt Strike Beacon, to establish a foothold within the compromised network.
Sharp Dragon is also known for its use of compromised infrastructure. Instead of relying solely on their own servers, the group frequently exploits existing, legitimate servers to facilitate their operations. This approach not only helps in evading detection but also provides them with a more robust and covert method of command and control (C2). They have been observed using compromised servers to both execute malicious commands and exfiltrate stolen data.
In recent operations, Sharp Dragon has shown a notable shift in their targeting strategy, expanding their focus to regions beyond their historical bases. They have increasingly targeted governmental organizations in Africa and the Caribbean, leveraging previous compromises in South-East Asia to facilitate these new attacks. This expansion reflects a broader strategic effort to enhance their influence and gather intelligence from new geographical regions.
MITRE Tactics and Techniques
Initial Access – T1078
Execution – T1059
Persistence – T1053
Privilege Escalation – T1068
Defense Evasion – T1027
Credential Access – T1003
Discovery – T1046
Lateral Movement – T1076
Collection – T1213
Command and Control – T1071
Exfiltration – T1041
Impact – T1486
