CVE Intelligence
Home / Threat actors / Naikon

Naikon G0019

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
21
Techniques
15
Malware and tools

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).

While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Initial Access
T1078.002 Domain AccountsT1566.001 Spearphishing Attachment
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1204.002 Malicious FileT1574.001 DLL
Persistence
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1137.006 Add-insT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1078.002 Domain AccountsT1547.001 Registry Run Keys / Startup Folder
Stealth
T1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078.002 Domain AccountsT1574.001 DLL
Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1046 Network Service DiscoveryT1518.001 Security Software Discovery

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.