MITRE ATT&CKsoftware (malware)

S9024 SPAWNCHIMERA

Published 2026-04-17 Modified 2026-04-23 Official page ↗
Domain
enterprise
Platforms
Linux, Network Devices
Version
1.0
Created
2026-04-17

Description

SPAWNCHIMERA is a backdoor that supports command and control and can inject malicious components into native processes. SPAWNCHIMERA It incorporates capabilities from multiple tools within the SPAWN malware family, including SPAWNANT, SPAWNMOLE, and SPAWNSNAIL. SPAWNCHIMERA was first reported in April 2024. SPAWNCHIMERA has been observed in activity attributed to People's Republic of China (PRC) state-sponsored threat actors, including UNC5221..

Related

Uses · MITRE ATT&CK (23)

  • T1685 Disable or Modify Tools technique
  • T1690 Prevent Command History Logging technique
  • T1678 Delay Execution technique
  • T1480.002 Mutual Exclusion sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1572 Protocol Tunneling technique
  • T1571 Non-Standard Port technique
  • T1574.006 Dynamic Linker Hijacking sub-technique
  • T1574 Hijack Execution Flow technique
  • T1059.006 Python sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1559 Inter-Process Communication technique
  • T1553.002 Code Signing sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.006 Timestomp sub-technique
  • T1055.002 Portable Executable Injection sub-technique
  • T1505.003 Web Shell sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1037 Boot or Logon Initialization Scripts technique
  • T1040 Network Sniffing technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique

References