{
  "name": "Silver Dragon Targets Organizations in Southeast Asia and Europe",
  "slug": "silver-dragon-targets-organizations-in-southeast-asia-and-europe",
  "description": "Check Point Research has identified a Chinese-nexus advanced persistent threat group named Silver Dragon, targeting organizations in Southeast Asia and Europe since mid-2024. The group, likely operating under APT41, exploits public-facing servers and uses phishing emails for initial access. They deploy custom tools including GearDoor, a backdoor using Google Drive for command and control, SSHcmd for remote access, and SilverScreen for covert screen monitoring. Silver Dragon primarily focuses on government entities, utilizing Cobalt Strike beacons and DNS tunneling for communication. The group's sophisticated tactics and evolving toolkit demonstrate a well-resourced and adaptable threat actor.",
  "published": "2026-03-03T19:03:17+00:00",
  "created_at": "2026-03-03T19:03:17+00:00",
  "modified_at": "2026-03-04T10:17:02+00:00",
  "created_at_opencti": "2026-03-03T19:03:17+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-03",
    "apt",
    "chinese",
    "cobalt strike",
    "dns tunneling",
    "geardoor",
    "government",
    "silverscreen",
    "southeast asia",
    "sshcmd"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce"
      },
      {
        "id": "",
        "name": "51684a0e356513486489986f5832c948107ff687c8501d64846cdc4307429413"
      },
      {
        "id": "",
        "name": "85a03d2e74ae84093a74699057693d11e5c61f85b62e741778cbc5fc9f89022f"
      },
      {
        "id": "",
        "name": "43f8f94ca5aa0af7bfb0cc1d2f664a46500a161b2d082b48b516d084ef485348"
      },
      {
        "id": "",
        "name": "7f89a4d5af47bc00a9ad58f0bcbe8a7be2662953dcd03f0e881cc5cbf6b7bca8"
      },
      {
        "id": "",
        "name": "c4de1f1a8cb3b0392802ee56096ddb25b6f51c51350ce7c45e14d8c285765300"
      },
      {
        "id": "",
        "name": "2f787c1454891b242ab221b8b8b420373c3eb1a0c1fdcb624dd800c50758bbb0"
      },
      {
        "id": "",
        "name": "72e4b6540e32b8b7aac850055609bc5afc19e29834e9aa6be29a8ea59a2c9785"
      },
      {
        "id": "",
        "name": "3e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a"
      },
      {
        "id": "",
        "name": "967b5c611d304385807ea2d865fa561c15cde0473dd63e768679a4f29f0e4563"
      },
      {
        "id": "",
        "name": "740a09fcdefa5a5f79355b720f54ff09efa64062229fb388adbccd9c829e9ff0"
      },
      {
        "id": "",
        "name": "bcbe2f0a8134c0e7fce18d0394ababc1d910e6f7b77b8c07643434cd14f4c5d6"
      },
      {
        "id": "",
        "name": "5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e1654"
      },
      {
        "id": "",
        "name": "b93560c4d18120e113fb8b04a8aa05f66a12116d1fbf18a93186f6314381e97e"
      },
      {
        "id": "",
        "name": "4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a8"
      },
      {
        "id": "",
        "name": "19139a525ee9c22efd6a4842c4cd50ab2c5f9ee391e5531071df0bb4e685f55d"
      },
      {
        "id": "",
        "name": "bd699ed720e2bd7085b3444cb8f4d36870b5b48df1055ec6cc1553db3eef7faf"
      },
      {
        "id": "",
        "name": "e3b016f2fc865d0f53f635f740eb0203626517425ed9a2908058f96a3bcf470d"
      },
      {
        "id": "",
        "name": "a6b5448ba45f3f352f5f4c5376024891adda1ef8ebf62a8fe63424fa230c691d"
      },
      {
        "id": "",
        "name": "ddaca57f3d5f4986da052ca172631b351410d6f5831f6af351699c6201cc011b"
      },
      {
        "id": "",
        "name": "5341c7256542405abdd01ee288b08e49dcb6d1782be6b7bea63b459d80f9a8f5"
      },
      {
        "id": "",
        "name": "7384462d420bdc9683a4cac2a8ad19353a2aa7d2244c91e9182345777e811e33"
      },
      {
        "id": "",
        "name": "44e769efed3e4f9f04c52dcd13f15cead251a1a08827a2cb6ea68427522c7fbb"
      },
      {
        "id": "",
        "name": "74a11a07d167f8f5c0baa724d1f7708985c81d0ac3d0e4d7ef3f3220c335e009"
      },
      {
        "id": "",
        "name": "948468aba5c851952ebe56a5bf37904ed83a6c8cb520304db6938d79892f0a1b"
      },
      {
        "id": "",
        "name": "166e777cb72a7c4e126f8ed97e0a82e7ca9e87df7793fea811daf34e1e7e47a6"
      },
      {
        "id": "",
        "name": "16b9a7358be88632378ba20ba1430786f3b844694b1f876211ecdbecf5cccbc2"
      },
      {
        "id": "",
        "name": "3a2df7a2cfeca5ba315a29cf313268a53a22316c925e6b9760ead8f4df0d1f75"
      },
      {
        "id": "",
        "name": "568c67564d62b09d1a1bc29a494cf4bf31afddcafcf78592b178c63f23ccfcae"
      },
      {
        "id": "",
        "name": "3128bdb8efaaa04c0ba96337252f4cc2dc795021cbc410f74ace9dde958bac1d"
      },
      {
        "id": "",
        "name": "8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578"
      }
    ],
    "malware": [
      {
        "id": "4db442ff-3b2c-459e-b334-845da2eea5ab",
        "name": "SilverScreen",
        "slug": "silverscreen"
      },
      {
        "id": "ab138766-9b64-4880-87fb-1942a709d778",
        "name": "Cobalt Strike - S0154",
        "slug": "cobalt-strike-s0154"
      },
      {
        "id": "dbdcdcee-2b8b-4dd5-9b39-cd18ecf9c887",
        "name": "GearDoor",
        "slug": "geardoor"
      },
      {
        "id": "23157f66-648e-484e-9bc0-a53eb2078de6",
        "name": "SSHcmd",
        "slug": "sshcmd"
      }
    ],
    "intrusion_sets": [
      {
        "id": "9d107389-5279-448d-9c93-d92fb551fa9c",
        "name": "Silver Dragon",
        "slug": "silver-dragon"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "f65930b0-5581-4f3d-a367-a86ac78f407b",
        "name": "T1021.004"
      },
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "495b924e-a52e-4548-9379-4b92ad9b698d",
        "name": "T1001.003"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "de38dd3a-41d7-4621-8a00-a32d7f0ff420",
        "name": "T1102.002"
      },
      {
        "id": "6f00068c-812c-4e2b-9100-2cfa86b3aed9",
        "name": "T1132.001"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "ce39cd5d-9e4c-4138-b546-abd68e57f8c2",
        "name": "T1071.004"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "ccb28547-a340-4193-a5d9-69222f3d5051",
        "name": "T1049"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "ns1.exchange4study.com"
      },
      {
        "id": "",
        "name": "revitpourtous.com"
      },
      {
        "id": "",
        "name": "ns2.onedriveconsole.com"
      },
      {
        "id": "",
        "name": "zhydromet.com"
      },
      {
        "id": "",
        "name": "mindssurpass.com"
      },
      {
        "id": "",
        "name": "splunkds.com"
      },
      {
        "id": "",
        "name": "ns1.onedriveconsole.com"
      },
      {
        "id": "",
        "name": "oicm.org"
      },
      {
        "id": "",
        "name": "ampolice.org"
      },
      {
        "id": "",
        "name": "exchange4study.com"
      },
      {
        "id": "",
        "name": "wikipedla.blog"
      },
      {
        "id": "",
        "name": "onedriveconsole.com"
      },
      {
        "id": "",
        "name": "protacik.com"
      },
      {
        "id": "",
        "name": "bigflx.net"
      },
      {
        "id": "",
        "name": "copilot-cloud.net"
      }
    ]
  },
  "external_refs": [
    "https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/",
    "https://otx.alienvault.com/pulse/69a73e8545dc6a32312482a1"
  ]
}