LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0456: Aria-body

Aria-body is a custom backdoor that has been used by Naikon since approximately 2017.[1]

EnterpriseS0456MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Aria-body is a Windows custom backdoor associated in ATT&CK with Naikon and documented as in use since approximately 2017. Its mapped behaviors matter because they span persistence, discovery, collection, stealth, privilege-related token activity, and command-and-control. For leaders, the value is not just knowing the malware name; it is validating whether Windows endpoint, identity, and network controls can show the full chain from initial persistence and host reconnaissance through data staging and outbound communications.

Executive priority

Treat this as a coverage-validation case for espionage-style backdoor tradecraft on Windows. Priority questions include: can the organization prove visibility into suspicious startup persistence, process and token manipulation, removable media access, screen capture, archive creation, file deletion, and unusual web or non-application-layer outbound traffic? Because ATT&CK provides no official detection guidance for this object, confidence should come from local telemetry tests, incident response playbooks, and control evidence rather than from a single malware signature.

Technical view

Aria-body is mapped to Windows-relevant behaviors including Registry Run Keys/Startup Folder persistence, DLL injection, token impersonation or process creation with token, Native API use, multiple discovery techniques, collection from removable media and screen capture, archive creation, file deletion, encoded/encrypted files, deobfuscation, tool transfer, proxy use, web protocol C2, non-application-layer C2, and DGA-based C2. SOC and IR teams should validate detections around behavior clusters rather than the malware name alone: persistence plus discovery, injection or token activity plus outbound C2, collection or archiving plus file cleanup. The relationship to Naikon provides threat-intelligence context, but local alerting should remain behavior-based unless validated indicators are available from approved intelligence sources.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • Windows registry modification events for Run keys and Startup Folder paths
  • File creation, modification, deletion, archive, and removable media access telemetry
  • Process injection or cross-process memory/thread activity telemetry where available
  • Windows security events related to token use, impersonation, privileged process creation, and logon context

Detection direction

  • Do not rely on a named Aria-body signature as the primary control; ATT&CK does not provide official detection text for this malware object.
  • Correlate Windows startup persistence with nearby discovery activity such as process, user, system, network configuration, network connection, file, and window enumeration.
  • Tune for suspicious DLL injection and token impersonation patterns, especially when followed by new process creation or outbound network sessions.
  • Review removable media access, screen capture, and archive creation in context; these can be legitimate, so prioritize unusual parent processes, user context, timing, destination, and follow-on transfer behavior.
  • Monitor outbound web traffic, proxy-like behavior, non-standard protocols, and DNS patterns consistent with DGA use, while accounting for business applications that generate frequent or dynamic domains.

Mitigation priorities

  • Prioritize Windows endpoint hardening and EDR coverage for persistence, process injection, token abuse, and suspicious file operations.
  • Restrict and monitor autorun persistence locations, including Registry Run keys and Startup Folder execution paths.
  • Apply least privilege and credential hygiene to reduce the value of token impersonation or privileged process creation opportunities.
  • Control removable media use and ensure access is logged where sensitive data or regulated environments are involved.
  • Enforce network egress controls, DNS monitoring, and proxy logging so C2 over web protocols, proxies, non-standard protocols, or DGA-like domains is reviewable.
Additional notes and limits

The supplied ATT&CK object identifies Aria-body as a custom backdoor used by Naikon and provides a rich set of technique relationships, but no official detection guidance and no aliases. The object platform is Windows; some related techniques list additional platforms, but this take treats Windows as the supported platform for this malware object. The group relationship is useful for intelligence context, especially for organizations concerned with espionage risk, but it should not be used alone for attribution.

This assessment is limited to the supplied ATT&CK STIX fields, external references, and relationships. It does not include indicators of compromise, hashes, C2 infrastructure, malware configuration details, active exploitation status, victim exposure, or validated detection analytics. Local telemetry, business context, and approved threat-intelligence sources are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Aria-body

Aria-body is a custom backdoor that has been used by Naikon since approximately 2017.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1095Non-Application Layer Protocol

Aria-body has used TCP in C2 communications.[1]

EnterpriseT1057Process Discovery

Aria-body has the ability to enumerate loaded modules for a process.[1].

EnterpriseT1106Native API

Aria-body has the ability to launch files using ShellExecute.[1]

EnterpriseT1568.002Domain Generation AlgorithmsSub-technique

Aria-body has the ability to use a DGA for C2 communications.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Aria-body has the ability to decrypt the loader configuration and payload DLL.[1]

EnterpriseT1025Data from Removable Media

Aria-body has the ability to collect data from USB devices.[1]

EnterpriseT1016System Network Configuration Discovery

Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.[1]

EnterpriseT1134.002Create Process with TokenSub-technique

Aria-body has the ability to execute a process using runas.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Aria-body has used HTTP in C2 communications.[1]

EnterpriseT1113Screen Capture

Aria-body has the ability to capture screenshots on compromised hosts.[1]

EnterpriseT1033System Owner/User Discovery

Aria-body has the ability to identify the username on a compromised host.[1]

EnterpriseT1010Application Window Discovery

Aria-body has the ability to identify the titles of running windows on a compromised host.[1]

EnterpriseT1082System Information Discovery

Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.[1]

EnterpriseT1070.004File DeletionSub-technique

Aria-body has the ability to delete files and directories on compromised hosts.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Aria-body has established persistence via the Startup folder or Run Registry key.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Aria-body has used an encrypted configuration file for its loader.[1]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

Aria-body has the ability to duplicate a token from ntprint.exe.[1]

EnterpriseT1090Proxy

Aria-body has the ability to use a reverse SOCKS proxy module.[1]

EnterpriseT1105Ingress Tool Transfer

Aria-body has the ability to download additional payloads from C2.[1]

EnterpriseT1083File and Directory Discovery

Aria-body has the ability to gather metadata from a file and to search for file and directory names.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.[1]

EnterpriseT1680Local Storage Discovery

Aria-body has the ability to identify disk information on a compromised host.[1]

EnterpriseT1560Archive Collected Data

Aria-body has used ZIP to compress data gathered on a compromised host.[1]

EnterpriseT1049System Network Connections Discovery

Aria-body has the ability to gather TCP and UDP table status listings.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0019: Naikon

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).[1] Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).[1][2]

While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.[3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1095: Non-Application Layer ProtocolEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1568.002: Domain Generation AlgorithmsEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1025: Data from Removable MediaEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1134.002: Create Process with TokenEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1010: Application Window DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1134.001: Token Impersonation/TheftEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1560: Archive Collected DataEnterpriseuses · GroupG0019: NaikonEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
f09f9656c656e10b...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundlef09f9656c656…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  2. [2]
    Bitdefender Naikon April 2021

    Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.

    Open source URL
  3. [3]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  4. [4]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  5. [5]
    mitre-attackS0456
    Open source URL
  6. [6]
    mitre-attackS0456
    Open source URL
  7. [7]
    mitre-attackS0456
    Open source URL
  8. [8]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  9. [9]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  10. [10]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  11. [11]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  12. [12]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  13. [13]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  14. [14]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  15. [15]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  16. [16]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  17. [17]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  18. [18]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  19. [19]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  20. [20]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  21. [21]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  22. [22]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  23. [23]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  24. [24]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  25. [25]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  26. [26]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  27. [27]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  28. [28]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  29. [29]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  30. [30]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  31. [31]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  32. [32]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  33. [33]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  34. [34]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  35. [35]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  36. [36]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  37. [37]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  38. [38]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  39. [39]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  40. [40]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  41. [41]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  42. [42]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  43. [43]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  44. [44]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  45. [45]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  46. [46]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  47. [47]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  48. [48]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  49. [49]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  50. [50]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  51. [51]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
  52. [52]
    CheckPoint Naikon May 2020

    CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use