MITRE ATT&CKgroup

G0001 Axiom

Published 2017-05-31 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Group 72
Version
2.0
Created
2017-05-31

Description

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.

Related

Uses · MITRE ATT&CK (24)

  • S0672 Zox software (malware)
  • T1583.002 DNS Server sub-technique
  • T1583.003 Virtual Private Server sub-technique
  • T1584.005 Botnet sub-technique
  • T1001.002 Steganography sub-technique
  • T1566 Phishing technique
  • T1563.002 RDP Hijacking sub-technique
  • T1560 Archive Collected Data technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1553 Subvert Trust Controls technique
  • T1546.008 Accessibility Features sub-technique
  • S0412 ZxShell software (malware)
  • S0203 Hydraq software (malware)
  • T1189 Drive-by Compromise technique
  • T1190 Exploit Public-Facing Application technique
  • T1203 Exploitation for Client Execution technique
  • S0009 Hikit software (malware)
  • S0012 PoisonIvy software (malware)
  • S0013 PlugX software (malware)
  • S0021 Derusbi software (malware)
  • S0032 gh0st RAT software (malware)
  • T1003 OS Credential Dumping technique
  • T1005 Data from Local System technique
  • T1078 Valid Accounts technique

References