{
  "aliases": [
    "deadringer"
  ],
  "attack_id": "G0019",
  "attack_name": "Naikon",
  "attack_url": "https://attack.mitre.org/groups/G0019/",
  "counts": {
    "domain": 63,
    "ipv4": 21
  },
  "first_seen": {
    "domain": {
      "a.jrmfeeder.org": "2021-08-04",
      "afhkl.dseqoorg.com": "2021-08-04",
      "ahzx.eicp.net": "2020-05-07",
      "ajtkgygth.com": "2020-05-07",
      "aloha.fekeigawy.com": "2021-04-29",
      "articles.whynotad.com": "2017-04-14",
      "asp.asphspes.com": "2021-04-29",
      "asphspes.com": "2021-04-29",
      "bbs.forcejoyt.com": "2020-05-07",
      "bkav.imshop.in": "2020-05-07",
      "blog.toptogear.com": "2020-05-07",
      "cat.suttiphong.com": "2021-04-29",
      "cent.myanmarnewsrecent.com": "2021-04-29",
      "cpc.mashresearchb.com": "2020-05-07",
      "dathktdga.com": "2020-05-07",
      "dgwktifrn.com": "2021-04-29",
      "dns.jmrmfitym.com": "2020-05-07",
      "dns.seekvibega.com": "2020-05-07",
      "dthjxc.com": "2021-04-29",
      "familymart-pay.cc": "2023-11-12",
      "fekeigawy.com": "2021-04-29",
      "freebsd.extrimtur.com": "2017-04-14",
      "googlemm.vicp.net": "2020-05-07",
      "guaranteed9.strangled.net": "2017-04-14",
      "hosts.mysaol.com": "2017-04-14",
      "http.jmrmfitym.com": "2021-04-29",
      "imgs09.homenet.org": "2017-04-14",
      "java.tripadvisorsapp.com": "2021-04-29",
      "jdk.gsvvfsso.com": "2021-08-04",
      "jmrmfitym.com": "2021-04-29",
      "kyawtun119.com": "2020-05-07",
      "kyemtyjah.com": "2020-05-07",
      "mail.tripadvisorsapp.com": "2021-04-29",
      "mncgn.51vip.biz": "2020-05-07",
      "mon-enews.com": "2020-05-07",
      "my.eiyfmrn.com": "2021-08-04",
      "myanmarnewsrecent.com": "2021-04-29",
      "myanmartech.vicp.net": "2020-05-07",
      "n91t78dxr3.com": "2020-05-07",
      "news.dgwktifrn.com": "2021-04-29",
      "news.nyhedmgtxck.com": "2020-05-07",
      "nw.eiyfmrn.com": "2021-08-04",
      "osde.twifwkeyh.com": "2021-04-29",
      "php.tripadvisorsapp.com": "2021-04-29",
      "qisxnikm.com": "2020-05-07",
      "rad.geewkmy.com": "2020-05-07",
      "realteks.gjdredj.com": "2020-05-07",
      "rrgwmmwgk.com": "2020-05-07",
      "second.photo-frame.com": "2017-04-14",
      "seekvibega.com": "2021-04-29",
      "spool.jtjewifyn.com": "2020-05-07",
      "sugano.trictalmk.com": "2020-05-07",
      "suttiphong.com": "2021-04-29",
      "thailand.vicp.net": "2020-05-07",
      "tnelgnmc.com": "2021-04-29",
      "tripadvisorsapp.com": "2021-04-29",
      "ttareyice.jkub.com": "2020-09-08",
      "twifwkeyh.com": "2021-04-29",
      "ubaoyouxiang.gicp.net": "2020-05-07",
      "vietnam.gnway.net": "2020-05-07",
      "wahatmrjn.com": "2021-04-29",
      "wdrfjkg129.com": "2020-05-07",
      "web01.crabdance.com": "2017-04-14"
    },
    "ipv4": {
      "124.156.241.24:8550": "2021-04-29",
      "150.109.178.252:1111": "2021-04-29",
      "150.109.178.252:15784": "2021-04-29",
      "150.109.178.252:2356": "2021-04-29",
      "150.109.178.252:3333": "2021-04-29",
      "150.109.178.252:4152": "2021-04-29",
      "150.109.178.252:4444": "2021-04-29",
      "150.109.178.252:4528": "2021-04-29",
      "150.109.178.252:7859": "2021-04-29",
      "150.109.178.252:792": "2021-04-29",
      "150.109.178.252:7954": "2021-04-29",
      "150.109.184.127:1111": "2021-04-29",
      "150.109.184.127:15784": "2021-04-29",
      "150.109.184.127:3333": "2021-04-29",
      "150.109.184.127:4152": "2021-04-29",
      "150.109.184.127:4444": "2021-04-29",
      "150.109.184.127:4528": "2021-04-29",
      "150.109.184.127:7859": "2021-04-29",
      "150.109.184.127:792": "2021-04-29",
      "150.109.184.127:7954": "2021-04-29",
      "47.241.127.190:443": "2021-04-29"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {}
  },
  "first_seen_range": {
    "earliest": "2017-04-14",
    "latest": "2023-11-12"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "a.jrmfeeder.org",
      "afhkl.dseqoorg.com",
      "ahzx.eicp.net",
      "ajtkgygth.com",
      "aloha.fekeigawy.com",
      "articles.whynotad.com",
      "asp.asphspes.com",
      "asphspes.com",
      "bbs.forcejoyt.com",
      "bkav.imshop.in",
      "blog.toptogear.com",
      "cat.suttiphong.com",
      "cent.myanmarnewsrecent.com",
      "cpc.mashresearchb.com",
      "dathktdga.com",
      "dgwktifrn.com",
      "dns.jmrmfitym.com",
      "dns.seekvibega.com",
      "dthjxc.com",
      "familymart-pay.cc",
      "fekeigawy.com",
      "freebsd.extrimtur.com",
      "googlemm.vicp.net",
      "guaranteed9.strangled.net",
      "hosts.mysaol.com",
      "http.jmrmfitym.com",
      "imgs09.homenet.org",
      "java.tripadvisorsapp.com",
      "jdk.gsvvfsso.com",
      "jmrmfitym.com",
      "kyawtun119.com",
      "kyemtyjah.com",
      "mail.tripadvisorsapp.com",
      "mncgn.51vip.biz",
      "mon-enews.com",
      "my.eiyfmrn.com",
      "myanmarnewsrecent.com",
      "myanmartech.vicp.net",
      "n91t78dxr3.com",
      "news.dgwktifrn.com",
      "news.nyhedmgtxck.com",
      "nw.eiyfmrn.com",
      "osde.twifwkeyh.com",
      "php.tripadvisorsapp.com",
      "qisxnikm.com",
      "rad.geewkmy.com",
      "realteks.gjdredj.com",
      "rrgwmmwgk.com",
      "second.photo-frame.com",
      "seekvibega.com",
      "spool.jtjewifyn.com",
      "sugano.trictalmk.com",
      "suttiphong.com",
      "thailand.vicp.net",
      "tnelgnmc.com",
      "tripadvisorsapp.com",
      "ttareyice.jkub.com",
      "twifwkeyh.com",
      "ubaoyouxiang.gicp.net",
      "vietnam.gnway.net",
      "wahatmrjn.com",
      "wdrfjkg129.com",
      "web01.crabdance.com"
    ],
    "ipv4": [
      "124.156.241.24:8550",
      "150.109.178.252:1111",
      "150.109.178.252:15784",
      "150.109.178.252:2356",
      "150.109.178.252:3333",
      "150.109.178.252:4152",
      "150.109.178.252:4444",
      "150.109.178.252:4528",
      "150.109.178.252:7859",
      "150.109.178.252:792",
      "150.109.178.252:7954",
      "150.109.184.127:1111",
      "150.109.184.127:15784",
      "150.109.184.127:3333",
      "150.109.184.127:4152",
      "150.109.184.127:4444",
      "150.109.184.127:4528",
      "150.109.184.127:7859",
      "150.109.184.127:792",
      "150.109.184.127:7954",
      "47.241.127.190:443"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "NAIKON"
  ],
  "references": [
    "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf",
    "https://otx.alienvault.com/pulse/6089e5d691047973f36af713",
    "https://otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0",
    "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/",
    "https://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back/",
    "https://securelist.com/the-naikon-apt/69953/",
    "https://twitter.com/Arkbird_SOLG/status/1387548235246473220",
    "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf",
    "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos#lateral-movement-paexec",
    "https://www.virustotal.com/gui/domain/familymart-pay.cc/community"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0096"
    },
    {
      "evidence": [
        {
          "detail": "shares ftp, Systeminfo",
          "kind": "software",
          "weight": 0.367
        }
      ],
      "slug": "G0049"
    }
  ],
  "slug": "G0019",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-11-12",
      "indicators": {
        "domain": [
          "familymart-pay.cc"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/domain/familymart-pay.cc/community"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-08-04",
      "indicators": {
        "domain": [
          "a.jrmfeeder.org",
          "afhkl.dseqoorg.com",
          "jdk.gsvvfsso.com",
          "my.eiyfmrn.com",
          "nw.eiyfmrn.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos#lateral-movement-paexec",
        "https://otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 22,
        "ipv4": 21
      },
      "first_seen": "2021-04-29",
      "indicators": {
        "domain": [
          "aloha.fekeigawy.com",
          "asp.asphspes.com",
          "asphspes.com",
          "cat.suttiphong.com",
          "cent.myanmarnewsrecent.com",
          "dgwktifrn.com",
          "dthjxc.com",
          "fekeigawy.com",
          "http.jmrmfitym.com",
          "java.tripadvisorsapp.com",
          "jmrmfitym.com",
          "mail.tripadvisorsapp.com",
          "myanmarnewsrecent.com",
          "news.dgwktifrn.com",
          "osde.twifwkeyh.com",
          "php.tripadvisorsapp.com",
          "seekvibega.com",
          "suttiphong.com",
          "tnelgnmc.com",
          "tripadvisorsapp.com",
          "twifwkeyh.com",
          "wahatmrjn.com"
        ],
        "ipv4": [
          "124.156.241.24:8550",
          "150.109.178.252:1111",
          "150.109.178.252:15784",
          "150.109.178.252:2356",
          "150.109.178.252:3333",
          "150.109.178.252:4152",
          "150.109.178.252:4444",
          "150.109.178.252:4528",
          "150.109.178.252:7859",
          "150.109.178.252:792",
          "150.109.178.252:7954",
          "150.109.184.127:1111",
          "150.109.184.127:15784",
          "150.109.184.127:3333",
          "150.109.184.127:4152",
          "150.109.184.127:4444",
          "150.109.184.127:4528",
          "150.109.184.127:7859",
          "150.109.184.127:792",
          "150.109.184.127:7954",
          "47.241.127.190:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Arkbird_SOLG/status/1387548235246473220",
        "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf",
        "https://otx.alienvault.com/pulse/6089e5d691047973f36af713"
      ],
      "total": 43
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-09-08",
      "indicators": {
        "domain": [
          "ttareyice.jkub.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos#lateral-movement-paexec",
        "https://otx.alienvault.com/pulse/610a4bcdb92be5581d1071f0"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2020-05-07",
      "indicators": {
        "domain": [
          "ajtkgygth.com",
          "bbs.forcejoyt.com",
          "blog.toptogear.com",
          "cpc.mashresearchb.com",
          "dathktdga.com",
          "dns.jmrmfitym.com",
          "kyawtun119.com",
          "kyemtyjah.com",
          "mon-enews.com",
          "n91t78dxr3.com",
          "news.nyhedmgtxck.com",
          "qisxnikm.com",
          "rad.geewkmy.com",
          "realteks.gjdredj.com",
          "rrgwmmwgk.com",
          "spool.jtjewifyn.com",
          "sugano.trictalmk.com",
          "wdrfjkg129.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"
      ],
      "total": 18
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2020-05-07",
      "indicators": {
        "domain": [
          "ahzx.eicp.net",
          "bkav.imshop.in",
          "googlemm.vicp.net",
          "mncgn.51vip.biz",
          "myanmartech.vicp.net",
          "thailand.vicp.net",
          "ubaoyouxiang.gicp.net",
          "vietnam.gnway.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/the-naikon-apt/69953/",
        "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-05-07",
      "indicators": {
        "domain": [
          "dns.seekvibega.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/",
        "https://twitter.com/Arkbird_SOLG/status/1387548235246473220",
        "https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf",
        "https://otx.alienvault.com/pulse/6089e5d691047973f36af713"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2017-04-14",
      "indicators": {
        "domain": [
          "articles.whynotad.com",
          "freebsd.extrimtur.com",
          "guaranteed9.strangled.net",
          "hosts.mysaol.com",
          "imgs09.homenet.org",
          "second.photo-frame.com",
          "web01.crabdance.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/analysis/publications/69567/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back/"
      ],
      "total": 7
    }
  ]
}