Naikon

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

1. CVE-2010-33332026-10-17

   1. “In addition to a high volume of files exploiting CVE-2012-0158, the MsnMM attackers for a brief period used RTLO (right to left override) techniques, and then attachments exploiting CVE-2010-3333.”

      cited as exploiting · named nearby · source: media.kasperskycontenthub.com ↗ · 2026-10-17

2. CVE-2012-01582026-10-17

   1. “For years, Naikon downloaders/backdoors were delivered to victim systems with kit- produced CVE-2012-0158 spear-phish.”

      cited as exploiting · source: media.kasperskycontenthub.com ↗ · 2026-10-17

   2. “The Naikon group used mostly spear-phished documents for the attacks, with CVE-2012-0158 exploits that dropped the group’s signature backdoor.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

   3. “This bait “document”, or email attachment, appears to be a standard Word document, but is in fact an CVE-2012-0158 exploit, an executable with a double extension, or an executable with an RTLO filename, so it can execute code without the user’s knowledge or consent.”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

   4. “This bait “document”, or email attachment, appears to be a standard Word document, but is in fact an CVE-2012-0158 exploit, an executable with a double extension, or an executable with an RTLO filename, so it can execute code without the user’s knowledge or consent.”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

1. 2015The Msnmm Campaigns: The Earliest Naikon APT CampaignsKaspersky ↗
2. 2015The Naikon APT: Tracking Down Geo-Political Intelligence Across APAC, One Nation At A TimeKaspersky ↗

1. 1.securelist.com/analysis/publications/69953/the-naikon-apt↗
2. 2.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-c…↗
3. 3.media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikon…↗
4. 4.usa.kaspersky.com/resource-center/threats/naikon-targeted-attacks↗
5. 5.web.archive.org/web/20210925164035/https://blog.trendmicro.com/trendla…↗
6. 6.threatconnect.com/blog/tag/naikon↗
7. 7.attack.mitre.org/groups/G0019↗
8. 8.secureworks.com/research/threat-profiles/bronze-geneva↗
9. 9.cyware.com/news/chinese-naikon-group-back-with-new-espionage-atta…↗
10. 10.cluster25.io/2022/04/29/lotus-panda-awake-last-strike↗
11. +6 more in the JSON record