Naikon

Executive Summary

Naikon, a state-sponsored espionage actor attributed to the Chinese PLA’s Chengdu Military Region Second Technical Reconnaissance Bureau (Unit 78020), has been active since at least 2010 and focuses on government, military, telecom, energy, and critical‑infrastructure targets in Southeast Asia, India, Singapore, Vietnam and China. The group relies heavily on spear‑phishing attachments, legitimate program masquerading, DLL side‑loading, and living‑off‑the‑land utilities to establish persistence, move laterally with stolen credentials, and exfiltrate data for intelligence purposes.

Goals & Targeting

Strategically, Naikon seeks to harvest politically sensitive or economically valuable data from governmental, defence and critical‑infrastructure entities across Southeast Asia and parts of South and East Asia for use by the Chinese state. By focusing on high‑value civil and military targets that are often less hardened against social engineering, the actor gains strategic advantage in shaping geopolitical narratives and strengthening China’s regional influence.

Key Capabilities

• Remote system discovery using NetBIOS scanner
• Spearphishing via attachments with targeted decoy documents
• Persistence via Windows Run registry entry
• DLL side‑loading into legitimate executables
• Masquerading services as legitimate (e.g., taskmgr)
• Disguising malware as legitimate applications (Chrome, Adobe, VMware)
• Use of netsh commands to discover firewall and network settings
• Leveraging administrator credentials for lateral movement
• Exploitation of Microsoft Word CVE-2012-0158 for initial access and privilege escalation
• Credential dumping via dedicated tools

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Naikon’s campaign pattern exhibits a deliberate, long‑lasting presence (since 2010), with repeated use of the same spear‑phishing vectors and persistence mechanisms across multiple victim countries. The actor primarily targets governmental, defence, telecom, financial‑services, energy sectors, often focusing on organisations linked to policy research or international bodies such as UNDP and ASEAN. Operations are carried out via a mix of custom backdoors (Aria-body/RainyDay) and off‑the‑shelf RATs (PlugX, RARSTONE), with a consistent use of DLL side‑loading and legitimate Windows utilities for stealth. While the group’s activity is intermittent at times, it maintains an operational tempo sufficient to sustain long‑term intelligence gathering without compromising detection by typical security controls.

IOC Patterns

• NetBIOS scan activity
• Suspicious DNS queries
• Spearphishing attachment delivery
• Registry Run key modification persistence
• DLL side-loading into legitimate processes
• Masqueraded service names
• Disguised malware as legitimate executables
• netsh command usage for firewall discovery
• Double‑extension executable attachments
• Exploitation of MS Word CVE-2012-0158
• Presence of Aria-body and RainyDay backdoors

Recommended Actions

• Implement robust spear‑phishing detection and email filtering that blocks malicious attachments and double‑extension files
• Monitor outbound network traffic for NetBIOS/LAN discovery patterns (e.g., nbtscan) and suspicious DNS queries
• Deploy threat intelligence feeds to detect known domain or IP indicators used by Aria-body and RainyDay backdoors
• Enforce strict monitoring of the registry Run key and scheduled task creation, with alerts for alterations tied to persistence
• Apply application whitelisting or DLL integrity checks to detect side‑loading into legitimate processes
• Detect and block disguised system services that mimic native Windows services (e.g., taskmgr)
• Audit privileged account usage and disable unused administrator credentials
• Patching Microsoft Office suite promptly to mitigate CVE‑2012‑0158 and similar vulnerabilities
• Provide targeted user training on recognising spear‑phishing attachments with decoy content
• Use endpoint detection and response solutions capable of detecting PlugX, RARSTONE, Aria-body, RainyDay and other RATs

Suggested Tags