MITRE ATT&CKgroup
G0114 Chimera
- Domain
- enterprise
- Version
- 2.2
- Created
- 2020-08-24
Description
Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.
Related
Uses · MITRE ATT&CK (65)
- T1685.005 Clear Windows Event Logs sub-technique
- T1680 Local Storage Discovery technique
- T1027.010 Command Obfuscation sub-technique
- S0521 BloodHound software (tool)
- T1589.001 Credentials sub-technique
- T1588.002 Tool sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1074.001 Local Data Staging sub-technique
- T1074.002 Remote Data Staging sub-technique
- T1078.002 Domain Accounts sub-technique
- T1574.001 DLL sub-technique
- T1069.001 Local Groups sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1114.001 Local Email Collection sub-technique
- T1114.002 Remote Email Collection sub-technique
- T1213.002 Sharepoint sub-technique
- T1003.003 NTDS sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1021.006 Windows Remote Management sub-technique
- T1110.003 Password Spraying sub-technique
References
- https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf Cycraft Chimera April 2020
- https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/ NCC Group Chimera January 2021