Naikon

Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.^[4]

Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.^[5]

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.^[5]

Naikon has modified a victim's Windows Run registry to establish persistence.^[4]

Naikon has used administrator credentials for lateral movement in compromised networks.^[4]

Naikon has convinced victims to open malicious attachments to execute malware.^[5]

Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.^[2]

Naikon has used malicious e-mail attachments to deliver malware.^[5]

Naikon has used schtasks.exe for lateral movement in compromised networks.^[4]