Introduction
APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches. FireEye APT30 Baumgartner Golovkin Naikon 2015
Activities and Tactics
Targeted Sectors: Government, Military, Government, Administration
Country of Origin: 🇨🇳 China
Risk Level: High
Incident Type: Espionage
Suspected Victims: United States, South Korea, Saudi Arabia, Thailand, Vietnam, Malaysia, India, Japan, Philippines, Hong Kong…
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
ATT&CK technique IDs (denormalized)
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- SHIPSHAPE (S0028) — malware
- BACKSPACE (S0031) — malware
- FLASHFLOOD (S0036) — malware
- NETEAGLE (S0034) — malware
- SPACESHIP (S0035) — malware
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [3] Baumgartner Golovkin Naikon 2015 Baumgartner, K., Golovkin, M.. (2015, May 14). The Naikon APT. Retrieved January 14, 2015. [4] FireEye APT30 FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.