MITRE ATT&CKgroup

G0019 Naikon

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
2.0
Created
2017-05-31

Description

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN). While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

Related

Uses · MITRE ATT&CK (29)

  • S0630 Nebulae software (malware)
  • S0629 RainyDay software (malware)
  • S0456 Aria-body software (malware)
  • T1078.002 Domain Accounts sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1137.006 Add-ins sub-technique
  • S0029 PsExec software (tool)
  • S0039 Net software (tool)
  • S0055 RARSTONE software (malware)
  • S0057 Tasklist software (tool)
  • S0058 SslMM software (malware)
  • S0059 WinMM software (malware)
  • S0060 Sys10 software (malware)
  • S0061 HDoor software (malware)
  • S0095 ftp software (tool)
  • S0096 Systeminfo software (tool)
  • S0097 Ping software (tool)
  • S0108 netsh software (tool)
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique

References