Technadu

Chinese Ink Dragon Group Expands Cyber Espionage in Europe

First seen 17 Dec 2025, 10:57 UTC • Theregister

•85% similarity •32.7

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Ink Dragon Group, linked to China, has infiltrated European government networks by exploiting misconfigured servers to establish relay nodes for cyber-espionage. Check Point reports that this campaign has affected several dozen victims, including government and telecommunications entities across Europe, Asia, and Africa.

ThreatCluster AI

Attack Flow

12 entities, 22 inferred relationships (STIX 2.1).

Threat Actor (3)

GRU
Ink Dragon
RudePanda

Technique (2)

Data Breach
Malware

Organization (1)

Malware (1)

FinalDraft

Affected Platform (3)

IIS
Microsoft IIS
SharePoint

Tool (2)

Microsoft Remote Desktop
Remote Desktop

Relationships

GRU uses FinalDraft
Ink Dragon uses FinalDraft
RudePanda uses FinalDraft
GRU uses Microsoft Remote Desktop
GRU uses Remote Desktop
Ink Dragon uses Microsoft Remote Desktop
Ink Dragon uses Remote Desktop
RudePanda uses Microsoft Remote Desktop
RudePanda uses Remote Desktop
GRU uses Data Breach
GRU uses Malware
Ink Dragon uses Data Breach
Ink Dragon uses Malware
RudePanda uses Data Breach
RudePanda uses Malware
GRU targets AWS
Ink Dragon targets AWS
RudePanda targets AWS
FinalDraft targets AWS
GRU related to IIS
GRU related to Microsoft IIS
GRU related to SharePoint

Community

Browse all →

Chinese Ink Dragon Group Expands Cyber Espionage in Europe

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading