Mongall

ATP Sandbox Adv. Heuristics

Description

Mongall is a backdoor that has been in use since at least 2013, including by the Aoqin Dragon threat actor in campaigns against organizations in Southeast Asia and Australia.

Stats

First seen: June 2022
Last seen: October 2026

MITRE ATT&CK techniques

15 techniques across 7 tactics.

TA0002 Execution

T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.011Rundll32

TA0007 Discovery

T1082System Information Discovery
T1120Peripheral Device Discovery
T1680Local Storage Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

Associated groups

G1007Aoqin Dragon

Alert name variants

Alert Name	Engine
Win32.Backdoor.Mongall	ATP Sandbox Adv. Heuristics
Win32.Trojan.Mongall	ATP Sandbox Adv. Heuristics

Related families

QakBot KONNI Bisonal BLINDINGCAN Latrodectus

References