Home / Threat actors / Axiom
Axiom G0001
Also known as: Group 72
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
4
associated CVEs
20
Techniques
8
Malware and tools
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.”
“Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.”
“Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.”
“Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.”
Techniques by tactic
Resource Development
T1583.002 DNS ServerT1583.003 Virtual Private ServerT1584.005 Botnet Initial Access
T1078 Valid AccountsT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1203 Exploitation for Client Execution Persistence
T1078 Valid AccountsT1546.008 Accessibility Features Privilege Escalation
T1078 Valid AccountsT1546.008 Accessibility Features Stealth
T1078 Valid Accounts Defense Impairment
T1553 Subvert Trust Controls Credential Access
T1003 OS Credential Dumping Lateral Movement
T1021.001 Remote Desktop ProtocolT1563.002 RDP Hijacking Collection
T1005 Data from Local SystemT1560 Archive Collected Data Command and Control
T1001.002 Steganography © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.