Axiom
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.
- ATT&CK ID
- G0001
- Origin
- China
- Techniques
- 15
- Tools
- 8
Also tracked as Group 72
Vulnerabilities it has exploited
- CVE-2012-1889 Microsoft XML Core ServicesUnscored · exploited in the wild
- CVE-2012-4792 Microsoft Internet ExplorerUnscored · exploited in the wild
- CVE-2013-3893 Microsoft Internet ExplorerUnscored · exploited in the wild
- CVE-2014-0322 Microsoft Internet ExplorerUnscored · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureCompromise Infrastructure
Initial Access
Valid AccountsDrive-by CompromiseExploit Public-Facing ApplicationPhishing
Execution
Exploitation for Client Execution
Persistence
Valid AccountsEvent Triggered Execution
Privilege Escalation
Valid AccountsEvent Triggered Execution
Stealth
Defense Impairment
Credential Access
Lateral Movement
Remote ServicesRemote Service Session Hijacking
Collection
Data from Local SystemArchive Collected Data
Command and Control
Software
Derusbi · Hikit · Hydraq · PlugX · PoisonIvy · Zox · ZxShell · gh0st RAT