Threat intelligence / Campaign

Night Dragon

[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)

Campaign

TypeCampaign

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)

34 recorded

Relationships

uses

Malware

uses

to at

Tool

uses

to Data from Local System

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Accounts

Technique

uses

to Dynamic Resolution

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to Fallback Channels

Technique

uses

to File and Directory Discovery

Technique

uses

Tool

uses

to Ingress Tool Transfer

Technique

uses

to Local Email Collection

Technique

uses

to Malicious Link

Technique

uses

Technique

uses

to Modify Registry

Technique

uses

to Pass the Hash

Technique

uses

to Password Cracking

Technique

uses

Tool

uses

to Remote Access Tools

Technique

uses

to Remote Data Staging

Technique

uses

to Security Account Manager

Technique

uses

Technique

uses

Technique

uses

to Software Packing

Technique

uses

to Spearphishing Link

Technique

uses

to System Owner/User Discovery

Technique

uses

Technique

uses

to Upload Malware

Technique

uses

to Valid Accounts

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

Malware

2 external

References

mitre-attack

C0002

McAfee Night Dragon

https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf