Skip to content

Chimera

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.

ATT&CK ID: G0114
Origin: China
Techniques: 49
Tools: 6

Techniques

Reconnaissance

Gather Victim Identity Information

Resource Development

Obtain Capabilities

Initial Access

Valid Accounts External Remote Services

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter Native API System Services Hijack Execution Flow

Persistence

Scheduled Task/Job Valid Accounts External Remote Services Modify Authentication Process

Privilege Escalation

Scheduled Task/Job Valid Accounts

Stealth

Obfuscated Files or Information Masquerading Indicator Removal Valid Accounts Hijack Execution Flow

Defense Impairment

Modify Authentication Process Disable or Modify Tools

Credential Access

OS Credential Dumping Brute Force Multi-Factor Authentication Interception Modify Authentication Process

Discovery

System Service Discovery Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery Permission Groups Discovery File and Directory Discovery Account Discovery System Time Discovery Network Share Discovery Password Policy Discovery Browser Information Discovery Domain Trust Discovery Local Storage Discovery

Lateral Movement

Remote Services Use Alternate Authentication Material Lateral Tool Transfer

Collection

Data from Network Shared Drive Data Staged Email Collection Automated Collection Data from Information Repositories Archive Collected Data

Command and Control

Application Layer Protocol Ingress Tool Transfer Protocol Tunneling

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Web Service

Software

BloodHound · Cobalt Strike · Mimikatz · Net · PsExec · esentutl

MITRE ATT&CK All threat actors