Naikon

Threat Actor Profile Updated a month ago

Download STIX

Preview STIX

Naikon is a threat actor, or group, known for its execution of actions with malicious intent. It is associated with various Advanced Persistent Threat (APT) groups originating from China, such as Growing Taurus and Parched Taurus, also known as Goblin Panda. Naikon has been linked to PLA Unit 78020/APT 30 and is synonymous with other groups like Mustang Panda and Nomad Panda. These groups have historically targeted countries in the Asia-Pacific region, carrying out widespread cyber attacks. The group has been particularly active in recent espionage campaigns, employing a backdoor known as Rainyday, which is linked to the Firefly group, another alias for Naikon. In addition, Naikon APT has been observed using DLL side-loading in attacks against military organizations in Southeast Asia, specifically with respect to SbieDll_Hook and SandboxieBITS.exe. The group installs a variety of software, including Cobalt Strike, Quasar RAT, HDoor, Gh0stCringe, and Winnti, all of which grant remote control to infected machines. In a notable incident, Naikon was spear-phished by an actor now referred to as "Hellsing". This led to a series of retaliatory actions between Naikon and Hellsing, as documented in "The Chronicles of the Hellsing APT: The Empire Strikes Back". Furthermore, Naikon's "operator X" has conducted espionage campaigns affecting numerous organizations in country X. Despite these activities, Naikon continues to pose a significant threat to cybersecurity, especially in the Asia-Pacific region.

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.

ID	Votes	Profile Description
Goblin Panda	2	Goblin Panda is a recognized threat actor, known for its malicious activities in the cyber world. Various research organizations have indicated that several Chinese Advanced Persistent Threat (APT) groups such as Growing Taurus (aka Naikon) and Parched Taurus (aka Goblin Panda) have leveraged this t
Mustang Panda	1	Mustang Panda, also known as Bronze President, Nomad Panda, Naikon, Earth Preta, and Stately Taurus, is a Chinese-aligned threat actor that has been associated with widespread attacks against various countries in the Asia-Pacific region. The group's malicious activities were first traced back to Mar
Growing Taurus	1	None
Parched Taurus	1	None

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Espionage

Apt

Backdoor

Proxy

Malware

Rat

Implant

Associated Malware

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
Gh0stcringe	Unspecified	1	Gh0stCringe is a variant of Gh0st RAT, a notorious malware that has been used in numerous cyber attacks. This malicious software is designed to exploit and damage computers or devices by infiltrating the system through suspicious downloads, emails, or websites, often unbeknownst to the user. Once in
Taurus	Unspecified	1	Taurus is a malicious software (malware) that has been associated with multiple cyber threat actors, notably Stately Taurus, Iron Taurus, and Starchy Taurus, all of which have connections to Chinese Advanced Persistent Threats (APTs). The malware is designed to infiltrate systems and steal personal
gh0st RAT	Unspecified	1	Gh0st RAT is a notorious malware that was originally developed by the C. Rufus Security Team in China and has been widely used for cyber espionage since its code leaked in 2008. This malicious software can infiltrate systems through suspicious downloads, emails, or websites, often without the user's
HDoor	Unspecified	1	HDoor is a malicious software (malware) that has been publicly available in Chinese forums since 2008. This malware, equipped with full backdoor capabilities, allows operators to perform a variety of tasks, making it a potent threat to computer systems. It can infect systems through suspicious downl

Associated Threat Actors

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
APT30	Unspecified	1	APT30, a threat actor suspected to be attributed to China, has been active since at least 2005. This group primarily targets members of the Association of Southeast Asian Nations (ASEAN). APT30 is notable for its sustained activity over an extended period and its ability to adapt and modify source c
Winnti	Unspecified	1	Winnti is a sophisticated threat actor group, first identified by Kaspersky in 2013, with activities dating back to at least 2007. The group has been associated with the Chinese nation-state and is part of a collective known as APT41, which also includes subgroups like Wicked Panda, Suckfly, and Bar

Associated Vulnerabilities

To see the evidence that has resulted in this association, create a free account

ID	Type	Votes	Profile Description
No associations to display

Source Document References

Information about the Naikon Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source	CreatedAt	Title
DARKReading	a month ago	CISO Corner: The NYSE & the SEC; Ransomware Negotiation Tips
DARKReading	a month ago	China-Linked Espionage Groups Target Asian Telecoms
Securityaffairs	a month ago	China-linked spies target Asian Telcos since at least 2021
CERT-EU	9 months ago	Connect the Dots on State-Sponsored Cyber Incidents - Targeting of government bodies in Australia and Southeast Asia
CERT-EU	10 months ago	Researchers Uncover Grayling APT's Ongoing Attack Campaign Across Industries
CERT-EU	10 months ago	New Report Uncovers 3 Distinct Clusters of China-Nexus Attacks on Southeast Asian Government
Unit42	10 months ago	Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus
MITRE	a year ago	The Naikon APT
MITRE	a year ago	ICIT Brief – China’s Espionage Dynasty: Economic Death by a Thousand Cuts