Naikon APT

Posted: May 8, 2020

Naikon APT Description

The Naikon APT is a group of hackers associated with China's military and espionage operations. They typically infiltrate targets with well-crafting phishing attacks and use a combination of custom tools, including Trojan downloaders and backdoor Trojans, for furthering their goals and collecting information. Workers in at-risk Southeast Asian government branches should have appropriate anti-malware protection for removing these hackers' tools immediately and watch for possible attacks through e-mail.

The Naikon APT: Not So 'Inactive' after All

With significant publicity from reports of their techniques and tools in 2015, the China-based Naikon APT fell off the radar quickly. Despite this period of silence, which lasted for years, they still were active and engaging in attacks. Thanks to changes in their SOP and software, they avoided further identification until relatively recently, in 2020. Only then did some of their 'new' methods and programs, like the Aria-body backdoor Trojan, come to the surface.

Both old and new attacks by the Naikon APT are consistent in using useful psychological tricks or social engineering from the outset. They start with public or collected documents, containing content of high relevance to the target, and re-build them with extra threatening content, thanks to tools like the RoyalRoad. Sending fraudulent e-mails with those documents as attachments lets them compromise new PCs, usually through a Trojan downloader. This loading element can drop a more comprehensive Black Hat tool for long-term surveillance, like the Aria-body backdoor Trojan.

The Naikon APT's goals are, apparently, non-commercial, with no interest in monetizing the lucrative information they acquire from infected systems immediately. However, they monitor sensitive targets over weeks or months, collecting any files, system data, or other content that they rate as being worth exfiltrating. For one of their more recently-in-use Trojans, they also show a close knowledge of what files they want, with one program's including a feature with filename-specific retrieval capabilities.

Finding Trojan Spies Hiding Low

The Naikon APT is, like most entities worthy of the classification as an Advanced Persistent Threat, capable of technologically-sophisticated attacks that leave few to no clues for victims. DLL-sideloading, arbitrary memory process injection, and using infected PCs as ad hoc C&C servers are some of their more newsworthy tactics. Updates to their Trojan utilities, including major ones that subtract and add features, are also routine between incidents.

Although e-mail is the infection vector of choice for most Naikon APT attacks, almost definitely, the exact format may vary slightly. Some versions use RAR or ZIP archives for attachments as obfuscation. Scenarios may involve tricking users into clicking on executables or weaponizing an RTF file. In most cases, the Naikon APT will use a Trojan downloader before moving onto its 'main' Trojan tool for getting system information and progressing from that point.

Users in Southeast Asian governments, those working with Internet access, particularly, should be cautious about e-mail attachments – whether or not a known contact seemingly sends them. Anti-malware products may delete threats related to the Naikon APT, but additional, overall network mitigation guidelines are highly necessary.

Taking one's eye off the metaphorical ball is never a viable strategy in the cyber-security sector. While the average PC user may forget about them, hackers like the Naikon APT will revisit, renew, and revitalize their methods of attack – at least, as long as they're getting paid.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to Naikon APT may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria.

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.

Leave a Reply

Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter. If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.