Naikon - G0019

Created: 2017-05-31T21:31:54.232Z

Modified: 2021-08-19T18:23:23.507Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Naikon

Description

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).(Citation: CameraShy)(Citation: Baumgartner Naikon 2015)

While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)

Techniques Used

Naikon renamed a malicious service

Naikon has modified a victim's Windows Run registry to establish persistence.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Naikon has used the LadonGo scanner to scan target networks.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Naikon has used a netbios scanner for remote machine identification.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|