3 malware familiesExploits CVEs in the wild

Naikon

Also known asNaikon

Naikon is a Chinese cyber espionage threat actor. The provided content explicitly places Naikon among suspected PLA-affiliated groups and notes that PLA-affiliated groups remain prominent within the Chinese cyber espionage sphere. Observed tradecraft in the content includes persistence via modification of the Windows Run registry; delivery through malicious email attachments and spearphishing attachments that require victims to open malicious files; use of disguised malicious programs masquerading as Google Chrome, Adobe, and VMware executables; lateral movement using WMIC.exe and schtasks.exe; network reconnaissance using the LadonGo scanner and a NetBIOS scanner for remote machine identification; and local network configuration discovery using commands such as "netsh interface show". The content also associates Naikon with malicious file execution and UDL-file-based spearphishing attachment activity. Known alias in the provided content: naikon.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

9 of 15 tactics53 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0043

Reconnaissance

1 technique

T1595

Active Scanning

TA0001

Initial Access

2 techniques

T1078

Valid Accounts

T1078.002×2

Domain Accounts

T1566

Phishing

T1566.001×20

Spearphishing Attachment

T1566.002×4

Spearphishing Link

TA0002

Execution

5 techniques

T1047×4

Windows Management Instrumentation

T1053

Scheduled Task/Job

T1053.005×7

Scheduled Task

T1059×2

Command and Scripting Interpreter

T1059.001×3

PowerShell

T1204

User Execution

T1204.001

Malicious Link

T1204.002×11

Malicious File

T1574

Hijack Execution Flow

T1574.001×4

DLL

TA0003

Persistence

4 techniques

T1053

Scheduled Task/Job

T1053.005×7

Scheduled Task

T1078

Valid Accounts

T1078.002×2

Domain Accounts

T1112×2

Modify Registry

T1547

Boot or Logon Autostart Execution

T1547.001×6

Registry Run Keys / Startup Folder

TA0004

Privilege Escalation

4 techniques

T1053

Scheduled Task/Job

T1053.005×7

Scheduled Task

T1078

Valid Accounts

T1078.002×2

Domain Accounts

T1484

Domain or Tenant Policy Modification

T1484.001

Group Policy Modification

T1547

Boot or Logon Autostart Execution

T1547.001×6

Registry Run Keys / Startup Folder

TA0005

Stealth

4 techniques

T1036×2

Masquerading

T1036.005

Match Legitimate Resource Name or Location

T1036.008

Masquerade File Type

T1078

Valid Accounts

T1078.002×2

Domain Accounts

T1564

Hide Artifacts

T1564.006

Run Virtual Instance

T1574

Hijack Execution Flow

T1574.001×4

DLL

TA0112

Defense Impairment

2 techniques

T1112×2

Modify Registry

T1484

Domain or Tenant Policy Modification

T1484.001

Group Policy Modification

TA0007

Discovery

6 techniques

T1016×6

System Network Configuration Discovery

T1018×4

Remote System Discovery

T1046×5

Network Service Discovery

T1069

Permission Groups Discovery

T1082

System Information Discovery

T1087

Account Discovery

T1087.002

Domain Account

TA0008

Lateral Movement

1 technique

T1021

Remote Services

T1021.002×2

SMB/Windows Admin Shares

T1021.003×2

Distributed Component Object Model

ARSENAL

Associated malware families

3 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

ImpacketThe following analytic detects the use of Impacket's wmiexec.py tool for lateral movement by identifying specific command-line parameters.2Mar 17, 2026

PowerViewThe following analytic detects the execution of PowerView PowerShell cmdlets Get-ObjectAcl or Get-DomainObjectAcl , which are used to enumerate Access Control List (ACL) permissions for Active Directory objects.1Mar 18, 2026

RainyDayRainyday: A backdoor associated with the Firefly group (aka Naikon).1Mar 18, 2026

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

IOCS

Observables

39 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

39 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 13, 2026

Detection: Windows Binary Execution from an Archive | Splunk Security Content

Listed as a threat actor associated with the malicious file execution technique detected by this analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows Netspy Network Scanner Execution | Splunk Security Content

Referenced in the detection annotations as a threat actor associated with reconnaissance/exploitation behavior relevant to Netspy-style network scanning.

splunk researchNews

Apr 13, 2026

Detection: Windows EFI Volume Mount Attempt Via Mountvol | Splunk Security Content

Listed in the detection annotations as a threat actor associated with EFI volume mounting / installation-related behavior.

splunk researchNews

Apr 13, 2026

Detection: Windows Universal Data Link File Creation | Splunk Security Content

Referenced as a threat actor associated with spearphishing attachment activity involving malicious file execution and potential credential capture via UDL files.

+147 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping31

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables39

Domains, IPs, and hashes tied to this actor, refreshed continuously.