Aoqin Dragon
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primarily targeting organizations in Southeast Asia and Australia. They assess that the threat actor's primary focus is espionage and relates to targets in Australia, Cambodia, Hong Kong, Singapore, and Vietnam. We track this activity as 'Aoqin Dragon'. The threat actor has a history of using document lures with pornographic themes to infect users and makes heavy use of USB shortcut techniques to spread the malware and infect additional targets. Attacks attributable to Aoqin Dragon typically drop one of two backdoors, Mongall and a modified version of the open source Heyoka project.
Source-reported aliases: UNC94. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Australia · 
Cambodia · 
Hong Kong · 
Singapore · 
Vietnam
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf