MalwareUsed by 1 actor

Aria-body

Aria-Body, also referred to as AR, is a Windows backdoor family associated with the China-linked Naikon espionage group. It was used in cyber-espionage operations targeting organizations in Southeast Asia and the South China Sea region, including government, military, intelligence, law-enforcement, and other high-value public-sector entities. The malware lineage appears connected to older Naikon tooling and has been observed in variants compiled between 2017 and 2018, with related Naikon operations continuing to rely on Aria-Body-linked loader infrastructure in later campaigns.

Aria-Body is typically deployed as an in-memory DLL backdoor and can be injected into legitimate processes to provide covert remote access while reducing on-disk exposure. Reported behaviors include process injection into common Windows processes, enumeration of loaded modules, execution of files through native Windows APIs, screenshot capture, collection of host and network-identifying information such as username, public IP address, domain name, and location, and collection of data from USB devices. The malware also supports file and directory deletion, indicating both operational tasking and cleanup capability.

The family includes persistence mechanisms through Windows Startup folder placement or Registry Run autoruns. It also contains functionality to decrypt loader configuration data and payload DLLs, reflecting staged loading and obfuscation practices. Command-and-control resilience is enhanced through use of a domain generation algorithm. Newer variants introduced keylogging functionality by early 2018, expanding the malware’s surveillance role.

Overall, Aria-Body is a modular espionage backdoor focused on stealthy persistence, host surveillance, system profiling, and operator-controlled post-compromise activity on Windows systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Naikon

Bitdefender confidently attributed this operation to the Naikon threat actor based on command-and-control servers and malicious payloads belonging to the Aria-Body loader malware family used in the group's past operations.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

Because Checkpoint covers the same technical points in their post, we provide this simple summary list: ... Shell/Process Management

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence5

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

Privilege Escalation

2 techniques

T1055Process InjectionEvidence2

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

T1547.001Registry Run Keys / Startup FolderEvidence5

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

T1027.013Encrypted/Encoded FileEvidence1

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

T1055Process InjectionEvidence2

T1070.004File DeletionEvidence3

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1140Deobfuscate/Decode Files or InformationEvidence4

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

T1497.001System ChecksEvidence1

When the dll is loaded, it registers a Windows class calling a specific Window procedure with ... an IP location verification against checkip.amazonaws[.]com

Credential Access

1 technique

T1056.001KeyloggingEvidence1

The most recent version of the backdoor utilizes another Window procedure to implement a raw input device based keystroke collector.

Discovery

6 techniques

T1016System Network Configuration DiscoveryEvidence3

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

T1033System Owner/User DiscoveryEvidence3

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence7

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence3

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1497.001System ChecksEvidence1

When the dll is loaded, it registers a Windows class calling a specific Window procedure with ... an IP location verification against checkip.amazonaws[.]com

Collection

3 techniques

T1025Data from Removable MediaEvidence1

AppleSeed can find and collect data from removable media devices. APT28 backdoor may collect the entire contents of an inserted USB device. Aria-body has the ability to collect data from USB devices. BADNEWS copies files with certain extensions from USB devices to a predefined directory.

T1056.001KeyloggingEvidence1

The most recent version of the backdoor utilizes another Window procedure to implement a raw input device based keystroke collector.

T1113Screen CaptureEvidence2

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence3

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1090ProxyEvidence1

When the dll is loaded, it registers a Windows class calling a specific Window procedure with a removable drive check, a CONNECT proxied callback to its main C2

T1105Ingress Tool TransferEvidence2

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1568.002Domain Generation AlgorithmsEvidence1

Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 years ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

hash.md5●●●●●●●●●●●●View more in app5 years ago

hash.sha256●●●●●●●●●●●●View more in app5 years ago

ACTIVITY FEED

Recent activity

59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

59 SOURCESView more in app

mitre attack websiteNews

Oct 28, 2025

Updates | MITRE ATT&CK®

... Aria-body ... (v1.2→v1.3) ...

mitre attack websiteNews

Oct 28, 2025

Updates - Updates - October 2025 | MITRE ATT&CK®

Aria-body (v1.2→v1.3)

cocomelonc githubNews

Sep 25, 2023

Malware development trick - part 36: Enumerate process modules. Simple C++ example. - cocomelonc

Malware referenced as using the process module enumeration technique described in the article.

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor capable of identifying the username on a compromised host.

+55 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Aria-body

Overall, Aria-Body is a modular espionage backdoor focused on stealthy persistence, host surveillance, system profiling, and operator-controlled post-compromise activity on Windows systems.