Naikon APT Hid Five-Year Espionage Attack Under Radar

mood · May 7, 2020

Naikon APT Hid Five-Year Espionage Attack Under Radar
May 7, 2020
https://threatpost.com/naikon-apt-five-year-espionage-attack/155492/

After five years under the radar, the Naikon APT group has been unmasked in a long-term espionage campaign against several governments in the Asia-Pacific region.

The Chinese APT group was first uncovered by Kaspersky researchers in 2015, in attacks against top-level government agencies around the South China Sea. After 2015, Naikon seemingly went silent. However, a recently discovered, widespread campaign reveals the group has actually spent the past five years quietly developing their skills and introducing the “Aria-body” backdoor into their arsenal of weapons.

“Naikon attempted to attack one of our customers by impersonating a foreign government – that’s when they came back onto our radar after a five-year absence, and we decided to investigate further,” said Lotem Finkelsteen, manager of threat intelligence at Check Point, in a Thursday analysis.
Click to expand...

The Campaign
Researchers observed several different infection chains being used to deliver the Aria-body RAT.
This RTF file was weaponized with the RoyalRoad exploit builder.

RoyalRoad then drops a loader called “intel.wll” into the victim’s Word startup folder, which ultimately downloads the payload.
Anti-Detection
Ultimately, Aria-body gives the APT group remote access to the infected PC or network, bypassing security measures.

“Naikon’s primary method of attack is to infiltrate a government body, then use that body’s contacts, documents and data to launch attacks on others, exploiting the trust and diplomatic relations between departments and governments to increase the chances of its attack succeeding,” said researchers.
Click to expand...

Check Point Research: Naikon APT: Cyber Espionage Reloaded

mood · May 8, 2020

Naikon’s Aria
May 8, 2020
https://securelist.com/naikons-aria/96899/

Our colleagues at Checkpoint put together a fine research writeup on some Naikon resources and activity related to “aria-body” that we detected in 2017 and similarly reported in 2018. To supplement their research findings, we are summarizing and publishing portions of the findings reported in our June 2018 “Naikon’s New AR Backdoor Deployment to Southeast Asia”. This malware and activity aligns with much of what the Checkpoint researchers brought to light today.

The Naikon APT became well-known in May 2015, when our public reporting first mentioned and then fully described the group as a long running presence in the APAC region. Even when the group shutdown much of their successful offensive activity after years of campaigns, Naikon maintained several splinter campaigns. Matching malware artifacts, functionality, and targeting demonstrates that the group continues to wage cyber-espionage campaigns in the South China Sea region during 2018.

So, the group has evolved bit since 2015, and their activity targeting these same profiles continues into 2018. We identified at least a half dozen individual variants from 2017 and 2018. [...]
Click to expand...

Similarities to past Naikon components
Naikon components going back to 2012 maintain heavy similarities with the current “Aria-body” modules. Not only is some of the functionality only lightly modified, but the same misspellings in error logging remains in their codebase.

Kudos to the Checkpoint researchers for providing new details of the Naikon story into the public discussion.
Click to expand...

mood · Apr 28, 2021

Cyberspies target military organizations with new Nebulae backdoor
April 28, 2021
https://www.bleepingcomputer.com/ne...tary-organizations-with-new-nebulae-backdoor/

A Chinese-speaking threat actor has deployed a new backdoor in multiple cyber-espionage operations spanning roughly two years and targeting military organizations from Southeast Asia.
Backdoor used for persistence backup after detection
During their attacks, Naikon abused legitimate software to side-load the second-stage malware dubbed Nebulae likely used to achieve persistence, according to research published today by security researchers at Bitdefender's Cyber Threat Intelligence Lab.

The malware is also designed to gain persistence by adding a new registry key to relaunch automatically on system restarts after login.

"The data we obtained so far tell almost nothing about the role of the Nebulae in this operation, but the presence of a persistence mechanism could mean that it is used as backup access point to victim in the case of a negative scenario for actors," Bitdefender researcher Victor Vrabie said.
Click to expand...

Log in or Sign up

Naikon APT Hid Five-Year Espionage Attack Under Radar

mood Updates Team

mood Updates Team

mood Updates Team

Log in or Sign up

Naikon APT Hid Five-Year Espionage Attack Under Radar

mood Updates Team

mood Updates Team

mood Updates Team

Useful Searches