H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Heyoka Backdoor

[Heyoka Backdoor](https://attack.mitre.org/software/S1027) is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by [Aoqin Dragon](https://attack.mitre.org/groups/G1007) since at least 2013.(Citation: SentinelOne Aoqin Dragon June 2022)(Citation: Sourceforge Heyoka 2022)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Heyoka Backdoor](https://attack.mitre.org/software/S1027) is a custom backdoor--based on the Heyoka open source exfiltration tool--that has been used by [Aoqin Dragon](https://attack.mitre.org/groups/G1007) since at least 2013.(Citation: SentinelOne Aoqin Dragon June 2022)(Citation: Sourceforge Heyoka 2022)

Labels

malware
16 recorded

Relationships

uses
from Aoqin Dragon
Group
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DNS
Technique
uses
to Dynamic-link Library Injection
Technique
uses
to Encrypted/Encoded File
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to Local Storage Discovery
Technique
uses
to Malicious File
Technique
uses
to Masquerade Task or Service
Technique
uses
to Peripheral Device Discovery
Technique
uses
to Process Discovery
Technique
uses
to Protocol Tunneling
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rundll32
Technique
uses
to System Service Discovery
Technique
3 external

References

mitre-attack
S1027
open
SentinelOne Aoqin Dragon June 2022
https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/
open
Sourceforge Heyoka 2022
https://heyoka.sourceforge.net/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance