Loading threat actor…
Naikon, also tracked as Firefly, is a long-running Chinese espionage threat actor focused primarily on intelligence collection in the Asia-Pacific region. The group has been associated with intrusions against military, government-adjacent, telecommunications, and other strategic targets, particularly in Southeast Asia. Some reporting has described Firefly as a Chinese APT possibly associated with PLA Unit 78020 and operating in the Southern Theater area of responsibility. Naikon is linked to the Rainyday backdoor family and has used DLL sideloading and shellcode loaders to establish covert access on victim systems. Observed tradecraft includes persistence through sideloaded malicious libraries launched by legitimate executables, credential theft through registry-hive dumping, keylogging, port scanning, enabling remote desktop access, and broader post-compromise network activity. In telecom-focused intrusions, Rainyday variants were deployed alongside other China-linked malware families, indicating either operational collaboration, shared tooling, or overlapping access patterns among Chinese espionage clusters. The actor has also been observed using cloud services to support espionage objectives. In one operation against a military organization in Southeast Asia, a Firefly-linked exfiltration utility wrapped a public Google Drive client in Python and used it to upload stolen data. Exfiltrated material included operational and administrative documents such as meeting notes, call transcripts, building plans, email folders, and accounting data. This reflects an emphasis on low-noise exfiltration through trusted third-party platforms. Known aliases include Firefly and Firefly (Naikon). High-confidence activity attributed to the group is consistent with state-aligned espionage rather than financially motivated crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage operation against a military organization in Southeast Asia using Google Drive for data exfiltration via a wrapped public Google Drive client.
China-linked espionage activity using the Rainyday backdoor delivered via multiple DLL sideloading chains (e.g., F-Secure fsstm.exe with fspmapi.dll; Proxifier renamed msproxy.exe with security.dll), decrypting XOR-encoded shellcode from on-disk files and executing it in-memory.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.