DragonOK__2014__fireeye-operation-quantum-entanglement.pdf

FireEye's Operation Quantum Entanglement analyzes two China-linked APT campaigns (Moafee and DragonOK) that share toolsets and TTPs — including custom RATs (CT/NewCT/NewCT2), Nflog, Mongall, PoisonIvy, Sysget/HelloBridge — and use HTRAN proxies and evasion techniques (CPU core checks, password‑protected documents, large null‑padded files); the report provides technical malware analysis, network beacon formats, decryption routines, IOCs and infrastructure attribution tying Moafee to Guangdong and DragonOK to Jiangsu provinces.