Chimera (G0114) | Threat Actor Index

About Chimera

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.

View MITRE record ↗

Techniques by Tactic (59)

Reconnaissance

T1589.001 Credentials

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote Services

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1106 Native APIT1569.002 Service ExecutionT1574.001 DLL

Persistence

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain AccountsT1133 External Remote ServicesT1556.001 Domain Controller Authentication

Privilege Escalation

T1053.005 Scheduled TaskT1078 Valid AccountsT1078.002 Domain Accounts

Stealth

T1027.010 Command ObfuscationT1036.005 Match Legitimate Resource Name or LocationT1070.004 File DeletionT1070.006 TimestompT1078 Valid AccountsT1078.002 Domain AccountsT1574.001 DLL

Defence Impairment

T1556.001 Domain Controller AuthenticationT1685.005 Clear Windows Event Logs

Credential Access

T1003.003 NTDST1110.003 Password SprayingT1110.004 Credential StuffingT1111 Multi-Factor Authentication InterceptionT1556.001 Domain Controller Authentication

Discovery

T1007 System Service DiscoveryT1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.001 Local GroupsT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1124 System Time DiscoveryT1135 Network Share DiscoveryT1201 Password Policy DiscoveryT1217 Browser Information DiscoveryT1482 Domain Trust DiscoveryT1680 Local Storage Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.006 Windows Remote ManagementT1550.002 Pass the HashT1570 Lateral Tool Transfer

Collection

T1039 Data from Network Shared DriveT1074.001 Local Data StagingT1074.002 Remote Data StagingT1114.001 Local Email CollectionT1114.002 Remote Email CollectionT1119 Automated CollectionT1213.002 SharepointT1560.001 Archive via Utility

Command & Control

T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool TransferT1572 Protocol Tunneling

Exfiltration

T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage

Toolsets (6)

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🔧

BloodHound S0521

Tool · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

PsExec S0029

Tool · Windows

🔧

esentutl S0404

Tool · Windows

References & Reports (2)