Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets

Summary: Palo Alto Networks Unit 42 used its AutoFocus threat intelligence service to link five phishing attacks against Japanese organizations between January and March 2015 to the group known as DragonOK, with each attack carrying a different variant of Sysget malware, also called HelloBridge. All Sysget files communicated with a single command and control server at biosnews[.]info, and Unit 42 identified five additional backdoors hosted there, including a new custom tool it named FormerFirstRAT alongside NFlog, PoisonIvy, NewCT and PlugX.

What you should know: Four of the five Sysget variants carried decoy documents, two of them obituaries, to convince targets they had opened a legitimate file, and the final campaign widened from a manufacturing firm to a second Japanese high-tech organization. The attackers also added the widely used PlugX backdoor to a toolkit that already included three previously known DragonOK tools, giving them several fallback options once a foothold was established.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026