ChinaAssessedPLA Unit 78020EspionageActive 2010 – 2021Naikon
Summary
Espionage group (MITRE G0019) that MITRE, following earlier vendor research, assesses as state-sponsored and attributes to the PLA Chengdu Military Region Second Technical Reconnaissance Bureau (Unit 78020). Active since at least 2010 against government, military and civil organisations in Southeast Asia and bodies such as UNDP and ASEAN; MITRE notes overlap with APT30 but not an exact match. Check Point (2020) found the Aria-body backdoor, with loaders back to 2017, used against governments in Australia, Indonesia, the Philippines, Vietnam, Thailand, Myanmar and Brunei, delivered by spear-phishing (T1566.001) with RoyalRoad RTFs that drop intel.wll into Word's startup folder (T1137.006). Bitdefender saw it against Southeast Asian military organisations from June 2019 to March 2021 with Aria-body, the Nebulae backdoor and, from September 2020, RainyDay. Tradecraft includes DLL side-loading (T1574.001), Run-key persistence (T1547.001), the LadonGo scanner (T1046), binaries disguised as Chrome, Adobe and VMware (T1036.005), and lateral movement with admin credentials and WMIC (T1078.002, T1047).
Attribution
MITRE (from 2015 vendor research); no government statement
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-07-31)
Assessed state-sponsored; attributed to PLA Chengdu MR Second Technical Reconnaissance Bureau (Unit 78020) - Check Point Research (Research, 2020-05-07)
A long-running Chinese-based operation against APAC governments
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Aria-body, Nebulae and RainyDay against Southeast Asian military organisations | 2019-06 – 2021-03 | Southeast Asia | Military | Bitdefender (2021-04-28) |
| Aria-body espionage against APAC national governments (foreign affairs, science and technology ministries) | 2017 – 2020 | Australia, Indonesia, Philippines, Vietnam, Thailand, Myanmar, Brunei | Government, Foreign Affairs, Science & Technology | Check Point Research (2020-05-07) — "ongoing" at publication |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| Aria-body | Backdoor | Windows |
| Nebulae | Backdoor | Windows |
| RainyDay | Backdoor | Windows |
| RARSTONE | Backdoor | Windows |
| SslMM | Backdoor | Windows |
| WinMM | Backdoor | Windows |
Infrastructure patterns
- Long-lived C2 domains; since 2019 mostly on ASN 45102 (Alibaba) (Check Point 2020)
- Compromised government email accounts used to send lures to other governments (Check Point 2020)
Reporting and advisories 3
- MITRE ATT&CK
G0019 — Naikon - Check Point Research
Naikon APT: Cyber Espionage Reloaded (May 2020) - Bitdefender
New Nebulae Backdoor Linked with the NAIKON Group (Apr 2021)