Naikon
Naikon is a threat group that has focused on targets around the South China Sea.[1] The group has been attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau(Military Unit Cover Designator 78020).[2] While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.[3]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1574 | .002 | Hijack Execution Flow: DLL Side-Loading |
Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.[4] |
| Enterprise | T1137 | .006 | Office Application Startup: Add-ins |
Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.[4] |
| Enterprise | T1566 | .001 | Phishing: Spearphishing Attachment |
Naikon has used malicious e-mail attachments to deliver malware.[4] |
| Enterprise | T1518 | .001 | Software Discovery: Security Software Discovery |
Naikon uses commands such as |
| Enterprise | T1016 | System Network Configuration Discovery |
Naikon uses commands such as |
|
| Enterprise | T1204 | .002 | User Execution: Malicious File |
Naikon has convinced victims to open malicious attachments to execute malware.[4] |