TIARAS - Moafee

Threat Actor Profile

High APT

Description

Moafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group DragonOK. (Citation: Haq 2014)

Confidence Score

90%

Known Aliases

Moafee

First Seen

Unknown

Last Updated

Unknown

Active Status

Active

Created

April 29, 2026

MITRE ATT&CK Techniques (1)

T1027.001 - Binary Padding

Defense Evasion

Indicators of Compromise

Loading IOCs…

IOC KQL for Sentinel

STIX Data

{'aliases': ['Moafee'],
 'created': '2017-05-31T21:31:46.025Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[Moafee](https://attack.mitre.org/groups/G0002) is a threat '
                'group that appears to operate from the Guandong Province of '
                'China. Due to overlapping TTPs, including similar custom '
                'tools, Moafee is thought to have a direct or indirect '
                'relationship with the threat group '
                '[DragonOK](https://attack.mitre.org/groups/G0017). (Citation: '
                'Haq 2014)',
 'external_references': [{'external_id': 'G0002',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0002'},
                         {'description': '(Citation: Haq 2014)',
                          'source_name': 'Moafee'},
                         {'description': 'Haq, T., Moran, N., Scott, M., & '
                                         'Vashisht, S. O. (2014, September '
                                         '10). The Path to Mass-Producing '
                                         'Cyber Attacks &#91;Blog&#93;. '
                                         'Retrieved November 12, 2014.',
                          'source_name': 'Haq 2014',
                          'url': 'https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html'}],
 'id': 'intrusion-set--2e5d3a83-fe00-41a5-9b60-237efc84832f',
 'modified': '2025-04-25T14:49:46.105Z',
 'name': 'Moafee',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.1'}