Loading story…
Researchers linked a sustained cyber-espionage campaign against military, government, and intelligence organizations in Southeast Asia to the Chinese-speaking Naikon threat actor, which used the FoundCore/RainyDay backdoor alongside a newly documented Nebulae implant. Bitdefender said Nebulae was typically delivered through DLL side-loading with legitimate software and used mainly for persistence and as a fallback access path after defenders detected other malware, while FoundCore handled reconnaissance, credential dumping, lateral movement, payload delivery, and ongoing remote access.
Technical reporting shows the intrusions relied on multi-stage loaders, obfuscated shellcode, and hijacked legitimate components to evade analysis and maintain access. Securelist documented related tradecraft in attacks on high-profile Vietnamese organizations, including side-loading through Microsoft Outlook components, RC4-encrypted communications, runtime repair of scrubbed PE headers, and service-based persistence, while separate Kaspersky research tied Naikon to the long-running Aria-Body backdoor family used against executive, law enforcement, military, and intelligence entities across the South China Sea region. The combined reporting indicates Naikon continued refining a long-running regional espionage toolkit rather than conducting isolated intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Bitdefender said the observed Naikon attacks using Nebulae and RainyDay/FoundCore ran through March 2021, relying on side-loading and DLL hijacking through legitimate applications.
Securelist listed a CoreLoader sample associated with the campaign with a creation time of 2020-11-21 03:47:14, indicating another malware stage used in the intrusion chain.
A DropPhone implant used in the intrusion chain had a recorded creation time of 2020-11-04 09:14:22 and was deployed after RoyalRoad-generated RTF exploitation.
Securelist reported a multi-stage intrusion campaign active from June 2020 to January 2021 that primarily targeted high-profile Vietnamese organizations and deployed the FoundCore RAT via DLL side-loading.
Bitdefender observed Naikon conducting cyber-espionage operations against military organizations in Southeast Asia, using the FoundCore/RainyDay backdoor and the Nebulae backdoor for persistence and backup access.
A newer AR sample compiled on 2018-02-22 added raw input device-based keylogging functionality, which Kaspersky said was absent from previous versions of the malware.
Kaspersky reported that Naikon continued cyber-espionage campaigns in Southeast Asia and the South China Sea region during 2018, targeting government, military, intelligence, and related organizations.
Kaspersky identified at least six AR/Aria-Body backdoor variants with compilation dates spanning from January 2017 to February 2018, used in cyber-espionage targeting Southeast Asian organizations.
Kaspersky reported that portions of Naikon's AR/Aria-Body codebase could be traced back to executable and DLL modules used in the group's operations since 2012, indicating long-term malware lineage continuity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcebleepingcomputer.com
Open sourcesecurelist.com
Open sourcebitdefender.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos has identified a campaign since 2022 targeting telecommunications and manufacturing sectors in Central and South Asia, using a new PlugX variant with technical overlaps to RainyDay and Turian backdoors. Analysis reveals shared malware loaders, RC4 keys, and infection chains, suggesting a medium-confidence link between Naikon and BackdoorDiplomacy, or shared tooling. The campaign demonstrates advanced DLL sideloading, living-off-the-land techniques, and persistent compromise, with evidence of keylogger activity spanning nearly two years.
Jun 29, 2026
Researchers documented **Hellsing**, an espionage group active across the Asia-Pacific region, after an unusual incident in which a recipient of a **Naikon** spear-phishing email sent back a weaponized archive that infected the original operators. The campaign primarily targeted organizations in **Malaysia, the Philippines, and Indonesia**, especially around the South China Sea, using spear-phishing messages with **RAR**, **ZIP**, and **7ZIP** attachments to deliver custom backdoors including **`msger`** and **`xweber`**. The malware set also included tools such as **`xrat`**, **`clare`**, **`irene`**, **`test.exe`**, **`diskfilter.sys`**, and **`xKat`** for victim profiling, proxy testing, lateral movement, and removing rival implants from compromised systems. Infrastructure and protocol overlaps linked the activity to other China-associated espionage clusters, while separate reporting highlighted **BKDR_RARSTONE** as another remote-access trojan to watch, reinforcing concern over archive-based malware delivery and custom RAT development in regional cyber-espionage operations.
Aug 14, 2026
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026