Forensia CTI Core

Profile

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN). While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

MITRE ATT&CK ↗

Techniques

14 ATT&CK techniques attributed to this actor.

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1046 Network Service Discovery T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1078.002 Domain Accounts T1137.006 Add-ins T1204.002 Malicious File T1518.001 Security Software Discovery T1547.001 Registry Run Keys / Startup Folder T1566.001 Spearphishing Attachment T1574.001 DLL

Software

15 malware/tools attributed to this actor.

PsExecNetRARSTONETasklistSslMMWinMMSys10HDoorftpSysteminfoPingnetshAria-bodyRainyDayNebulae

Related corpus activity

4,726 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Naikon.

Indicator	Type	Family	Sev	Src
cve-2023-44976	cve	ransomware	85	2
cve-2025-12057	cve	—	85	1
cve-2025-11837	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2013-7471	cve	—	85	1
cve-2026-3844	cve	—	85	1
cve-2026-22584	cve	—	85	2
cve-2013-3307	cve	—	85	2
cve-2025-34054	cve	—	85	4
cve-2014-2321	cve	—	85	1
cve-2020-17456	cve	—	85	1
cve-2017-18377	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2026-0740	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2016-15047	cve	—	85	4
cve-2024-1781	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2021-4045	cve	—	85	1
cve-2016-5681	cve	—	85	2
cve-2025-34117	cve	—	85	1
cve-2026-4368	cve	ransomware	85	1
cve-2021-25646	cve	—	85	1
cve-2022-47945	cve	—	85	1
cve-2026-1969	cve	—	85	1
cve-2025-34085	cve	—	85	1

Showing the top 30 by severity of 4,726.