Overview 84 indicators
Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN). While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.
| domain | 63 | G0019-domain.txt |
| ipv4 | 21 | G0019.json |
Techniques 14 ATT&CK
Open in ATT&CK Navigator → or download the layer (14 techniques, layer 4.5)
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1078.002 Domain Accounts
- T1137.006 Add-ins
- T1204.002 Malicious File
- T1518.001 Security Software Discovery
- T1547.001 Registry Run Keys / Startup Folder
- T1566.001 Spearphishing Attachment
- T1574.001 DLL
Software 15
Principal sources 10 reports
Ranked by how many of this actor's indicators each report brought in.
- 44twitter.com/Arkbird_SOLG/status/1387548235246473220
- 44bitdefender.com/files/News/CaseStudies/study/396/Bitdef…
- 44otx.alienvault.com/pulse/6089e5d691047973f36af713
- 19research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded
- 8securelist.com/the-naikon-apt/69953
- 8media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/072…
- 7securelist.com/analysis/publications/69567/the-chronic…
- 6cybereason.com/blog/deadringer-exposing-chinese-threat…
Related groups 2
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 84 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
virustotal.com/gui/domain/familymart-pay.cc/community
familymart-pay.cc -
cybereason.com/blog/deadringer-exposing-chinese-threat… · otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0
a.jrmfeeder.org afhkl.dseqoorg.com jdk.gsvvfsso.com my.eiyfmrn.com nw.eiyfmrn.com -
twitter.com/Arkbird_SOLG/status/1387548235246473220 · bitdefender.com/files/News/CaseStudies/study/396/Bitdef… · otx.alienvault.com/pulse/6089e5d691047973f36af713
domain aloha.fekeigawy.com domain asp.asphspes.com domain asphspes.com domain cat.suttiphong.com domain cent.myanmarnewsrecent.com domain dgwktifrn.com domain dthjxc.com domain fekeigawy.com domain http.jmrmfitym.com domain java.tripadvisorsapp.com domain jmrmfitym.com domain mail.tripadvisorsapp.com domain myanmarnewsrecent.com domain news.dgwktifrn.com domain osde.twifwkeyh.com domain php.tripadvisorsapp.com domain seekvibega.com domain suttiphong.com domain tnelgnmc.com domain tripadvisorsapp.com domain twifwkeyh.com domain wahatmrjn.com ipv4 124.156.241.24:8550 ipv4 150.109.178.252:1111 ipv4 150.109.178.252:15784 ipv4 150.109.178.252:2356 ipv4 150.109.178.252:3333 ipv4 150.109.178.252:4152 ipv4 150.109.178.252:4444 ipv4 150.109.178.252:4528 ipv4 150.109.178.252:7859 ipv4 150.109.178.252:792 ipv4 150.109.178.252:7954 ipv4 150.109.184.127:1111 ipv4 150.109.184.127:15784 ipv4 150.109.184.127:3333 ipv4 150.109.184.127:4152 ipv4 150.109.184.127:4444 ipv4 150.109.184.127:4528 ipv4 150.109.184.127:7859 ipv4 150.109.184.127:792 ipv4 150.109.184.127:7954 ipv4 47.241.127.190:443 -
cybereason.com/blog/deadringer-exposing-chinese-threat… · otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0
ttareyice.jkub.com -
research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded
ajtkgygth.com bbs.forcejoyt.com blog.toptogear.com cpc.mashresearchb.com dathktdga.com dns.jmrmfitym.com kyawtun119.com kyemtyjah.com mon-enews.com n91t78dxr3.com news.nyhedmgtxck.com qisxnikm.com rad.geewkmy.com realteks.gjdredj.com rrgwmmwgk.com spool.jtjewifyn.com sugano.trictalmk.com wdrfjkg129.com -
securelist.com/the-naikon-apt/69953 · media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/072…
ahzx.eicp.net bkav.imshop.in googlemm.vicp.net mncgn.51vip.biz myanmartech.vicp.net thailand.vicp.net ubaoyouxiang.gicp.net vietnam.gnway.net -
research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded · twitter.com/Arkbird_SOLG/status/1387548235246473220 · bitdefender.com/files/News/CaseStudies/study/396/Bitdef… · otx.alienvault.com/pulse/6089e5d691047973f36af713
dns.seekvibega.com -
securelist.com/analysis/publications/69567/the-chronic…
articles.whynotad.com freebsd.extrimtur.com guaranteed9.strangled.net hosts.mysaol.com imgs09.homenet.org second.photo-frame.com web01.crabdance.com
Further reading 12
- cdn2.hubspot.net/hubfs/454298/Project_CAMERASHY_ThreatCo…
- attack.mitre.org/groups/G0019
- media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/072…
- securelist.com/the-naikon-apt/69953
- research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded
- otx.alienvault.com/pulse/6089e5d691047973f36af713
- twitter.com/Arkbird_SOLG/status/1387548235246473220
- otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0
- virustotal.com/gui/domain/familymart-pay.cc/community
- bitdefender.com/files/News/CaseStudies/study/396/Bitdef…
- cybereason.com/blog/deadringer-exposing-chinese-threat…
- securelist.com/analysis/publications/69567/the-chronic…