Naikon

Naikon is a threat actor, or group, known for its execution of actions with malicious intent. It is associated with various Advanced Persistent Threat (APT) groups originating from China, such as Growing Taurus and Parched Taurus, also known as Goblin Panda. Naikon has been linked to PLA Unit 78020/APT 30 and is synonymous with other groups like Mustang Panda and Nomad Panda. These groups have historically targeted countries in the Asia-Pacific region, carrying out widespread cyber attacks. The group has been particularly active in recent espionage campaigns, employing a backdoor known as Rainyday, which is linked to the Firefly group, another alias for Naikon. In addition, Naikon APT has been observed using DLL side-loading in attacks against military organizations in Southeast Asia, specifically with respect to SbieDll_Hook and SandboxieBITS.exe. The group installs a variety of software, including Cobalt Strike, Quasar RAT, HDoor, Gh0stCringe, and Winnti, all of which grant remote control to infected machines. In a notable incident, Naikon was spear-phished by an actor now referred to as "Hellsing". This led to a series of retaliatory actions between Naikon and Hellsing, as documented in "The Chronicles of the Hellsing APT: The Empire Strikes Back". Furthermore, Naikon's "operator X" has conducted espionage campaigns affecting numerous organizations in country X. Despite these activities, Naikon continues to pose a significant threat to cybersecurity, especially in the Asia-Pacific region.