Moafee

Executive Summary

Moafee is an active threat actor suspected to operate from Guangdong Province, China. Linked with the DragonOK group due to similar TTPs and tools, Moafee targets various sectors including healthcare, pharmaceuticals, and gaming. They employ custom malware like PoisonIvy and use Binary Padding techniques, posing risks through phishing and supply chain attacks.

Goals & Targeting

Moafee likely targets sectors with high intellectual property value and sensitive data, such as healthcare, pharmaceuticals, and government. Their geographical focus includes the U.S., Japan, South Korea, and other countries, particularly those in which DragonOK has been active. The group's operational goals appear to align with financial gain, industrial espionage, or nation-state interests.

Moafee is a Chinese-speaking threat group identified in operations linked to DragonOK via shared tools and TTPs. Known for using custom tools such as PoisonIvy, a Remote Access Trojan (RAT), Moafee engages in Binary Padding attacks, injecting malicious code into legitimate binaries. Their activities suggest targeting sectors rich in intellectual property and sensitive data, including healthcare, pharmaceuticals, and government entities in the U.S., Japan, South Korea, and other regions. Operating since at least 2014, Moafee's campaigns involve spear phishing, supply chain compromise, and custom malware deployment to achieve financial gain, espionage, or strategic objectives.

Key Capabilities

• Custom malware development
• Binary Padding technique (T1027.001)
• Remote Access Trojan deployment (e.g., PoisonIvy)
• Spear phishing campaigns
• Supply chain compromise

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Moafee's campaigns exhibit a focus on sectors with valuable data, using phishing and malware deployment. While specific campaign details are limited, their activities align with those of DragonOK, indicating a focus on long-term access and strategic data extraction.

IOC Patterns

• Presence of PoisonIvy RAT
• Binary Padding anomalies in legitimate software
• Phishing emails targeting pharmaceutical/gaming sectors

Recommended Actions

• Monitor for Binary Padding indicators using endpoint detection tools.
• Implement supply chain security measures to detect and prevent malicious updates.
• Conduct regular network traffic analysis to identify suspicious domains or IPs linked to Moafee activity.

Suggested Tags