- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, PLA Unit 78020
- Agency named
- PLA
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2010–2026
- Status
- Active
- ATT&CK
- G0019 · 14 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0093 · naikon
ChinaWhat it is
Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020). Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).
While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Lotus Panda, Naikon, Lotus Panda, OVERRIDE PANDA
- Government agency
- PLA Unit 78020
- IBM X-Force
- ITG06
- MITRE ATT&CK
- G0019
- Secureworks
- BRONZE GENEVA, BRONZE STERLING
- Operations
- Operation “CameraShy”
- Other names
- Hellsing, Camerashy, NAIKON CASTLE
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Brunei, Cambodia, China, India, Indonesia, Laos, Malaysia, Myanmar, Nepal, Philippines, Saudi Arabia, Singapore, South Korea, Thailand, United States, Vietnam
- Sectors
- Defense, Diplomacy, Energy, Government, Infrastructure, Law enforcement, Media, Private sector
Tools
The tools and malware families the sources tie to it.
- Aria-body
- BACKSPACe
- HDoor
- NETEAGLE
- Nebulae
- Net
- Ping
- PsExec
- RARSTONE
- RainyDay
- SslMM
- Sys10
- Systeminfo
- Tasklist
- UNITEDRAKE
- WinMM
- XSControl
- ftp
- netsh
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de