Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 20:16:39 UTC
Home > List all groups > List all tools > List all groups using tool NFlog
 Tool: NFlog
Names NFlog
Category Malware
Type Backdoor
Description
(FireEye) We have observed DragonOK and Moafee use the Nflog implant in addition to
an earlier version of the NewCT2 implant. The password-protected XLS document (46ac-122183c32858581e95ef40bd31b3) referenced earlier also drops an “Nflog” implant
(a3d3b0686e7bd13293ad0e63ebec67af).
Information
<https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf>
AlienVault OTX <https://otx.alienvault.com/browse/pulses?q=tag:nflog>
Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool NFlog
Changed Name Country Observed
APT groups
  DragonOK 2015-Jan 2017  
  Moafee 2014  
2 groups listed (2 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d84c0e21-a3e4-4324-9065-c4f485c83bed
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d84c0e21-a3e4-4324-9065-c4f485c83bed
Page 1 of 1