Automation · API / MCP 中文

Group profile · G0019

Naikon

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN). While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

ATT&CK G0019 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2017

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).1 Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).23 While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.4

  1. CameraShy
  2. CameraShy
  3. Baumgartner Naikon 2015
  4. Baumgartner Golovkin Naikon 2015

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
also_known_asNaikon— → …100src_mitre_attck_enterprise
uses_techniquetech_t1078.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1547.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1518.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10462017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1137.0062017 → …100src_mitre_attck_enterprise
uses_techniquetech_t10162017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0042017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1053.0052017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022017 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012017 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1036.004Masquerade Task or Service—
T1036.005Match Legitimate Resource Name or Location—
T1046Network Service Discovery—
T1047Windows Management Instrumentation—
T1053.005Scheduled Task—
T1078.002Domain Accounts—
T1137.006Add-ins—
T1204.002Malicious File—
T1518.001Security Software Discovery—
T1547.001Registry Run Keys / Startup Folder—
T1566.001Spearphishing Attachment—
T1574.001DLL—

Aliases

Naikon

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections