China-based state-sponsored cyber espionage group targeting government and private sectors in Southeast Asia.
Analyst brief
Naikon is a China-based state-sponsored cyber espionage group. It primarily targets government and private sector entities across Southeast Asian countries. The actor heavily relies on spearphishing attachments for initial access, leverages custom malware like WinMM and RainyDay, and maintains persistence through Scheduled Tasks and Registry Run Keys. Defenders should enforce strict email attachment controls, monitor for anomalous use of WMI and Scheduled Tasks, and hunt for known Naikon malware signatures such as RARSTONE and HDoor.
Naikon
PLA Unit 78020OVERRIDE PANDACamerashy
nation-state
Kaspersky described Naikon in a 2015 report as: 'The Naikon group is mostly active in countries such as the Philippines, Malaysia, Cambodia, Indonesia, Vietnam, Myanmar, Singapore, and Nepal, hitting a variety of targets in a very opportunistic way.'
origin (suspected)
🇨🇳China· state-sponsoredattribution confidence: medium (50)
Monitor WMI queries and scheduled task creations to detect Windows Management Instrumentation and Scheduled Task, and block unnecessary WMI queries and scheduled tasks.
Monitor Office add-ins and registry changes to detect Add-ins and Registry Run Keys / Startup Folder, and block suspicious add-ins and registry changes.
Monitor suspicious process names and domain account activities to detect Match Legitimate Resource Name or Location and Domain Accounts, and block non-legitimate resource names and domain account activities.
Monitor network discovery queries and security software scans to detect Remote System Discovery and Security Software Discovery, and block unnecessary network discovery queries and security software scans.
FAQ2
How does the Naikon group achieve initial access to its targets?+
Naikon heavily relies on spearphishing attachments for initial access.
Which geographic region is Naikon most active in?+
Naikon is mostly active in Southeast Asian countries, including the Philippines, Malaysia, Cambodia, Indonesia, Vietnam, Myanmar, Singapore, and Nepal.