DragonOK Updates Toolset and Targets Multiple Geographic Regions

Unit42 reports DragonOK (an APT/threat actor) updated its toolset and conducted targeted campaigns across Japan, Taiwan, Tibet and Russia using phishing and RTF exploits (CVE-2015-1641) to deliver Sysget (v2–v4), IsSpace and newly observed TidePool malware; the blog provides technical analysis, network and file IOCs, decoy documents, and detection/mitigation guidance.