Naikon
MISPNation-state
CN
Unknown
[Naikon](https://attack.mitre.org/groups/G0019) is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, [Naikon](https://attack.mitre.org/groups/G0019) has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).(Citation: CameraShy)(Citation: Baumgartner Naikon 2015)
While [Naikon](https://attack.mitre.org/groups/G0019) shares some characteristics with [APT30](https://attack.mitre.org/groups/G0013), the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)
Tecniche Utilizzate (14)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1016 | System Network Configuration Discovery | - |
| T1018 | Remote System Discovery | - |
| T1036.004 | Masquerade Task or Service | - |
| T1036.005 | Match Legitimate Resource Name or Location | - |
| T1046 | Network Service Discovery | - |
| T1047 | Windows Management Instrumentation | - |
| T1053.005 | Scheduled Task | - |
| T1078.002 | Domain Accounts | - |
| T1137.006 | Add-ins | - |
| T1204.002 | Malicious File | - |
| T1518.001 | Security Software Discovery | - |
| T1547.001 | Registry Run Keys / Startup Folder | - |
| T1566.001 | Spearphishing Attachment | - |
| T1574.001 | DLL | - |
Riferimenti (10)
- securelist.com - The Naikon Apt
- fireeye.com - Spear Phishing The News Cycle Apt Actors Leverage Interest In The Disappearance Of Malaysian Flight Mh 370
- media.kasperskycontenthub.com - TheNaikonAPT MsnMM1.pdf
- usa.kaspersky.com - Naikon Targeted Attacks
- web.archive.org - Bkdr Rarstone New Rat To Watch Out For
- threatconnect.com - Naikon
- attack.mitre.org - G0019
- secureworks.com - Bronze Geneva
- cyware.com - Chinese Naikon Group Back With New Espionage Attack 66a8413d
- cluster25.io - Lotus Panda Awake Last Strike
Alias (1372)
Malware Utilizzato (15)
Metadata
| ID: | 21 |
| Created: | 13/01/2026 17:48 |
| Updated: | 21/04/2026 16:00 |