Chimera G0114

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

associated CVEs

Techniques

Malware and tools

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1589.001 Credentials

Resource Development

T1588.002 Tool

Initial Access

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1569.002 Service Execution T1574.001 DLL

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1556.001 Domain Controller Authentication

Privilege Escalation

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts

Stealth

T1027.010 Command Obfuscation T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.002 Domain Accounts T1574.001 DLL

Defense Impairment

T1556.001 Domain Controller Authentication T1685.005 Clear Windows Event Logs

Credential Access

T1003.003 NTDS T1110.003 Password Spraying T1110.004 Credential Stuffing T1111 Multi-Factor Authentication Interception T1556.001 Domain Controller Authentication

Discovery

T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1124 System Time Discovery T1135 Network Share Discovery T1201 Password Policy Discovery T1217 Browser Information Discovery T1482 Domain Trust Discovery T1680 Local Storage Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Collection

T1039 Data from Network Shared Drive T1074.001 Local Data Staging T1074.002 Remote Data Staging T1114.001 Local Email Collection T1114.002 Remote Email Collection T1119 Automated Collection T1213.002 Sharepoint T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer T1572 Protocol Tunneling

Exfiltration

T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

Malware and tools

Cobalt StrikeMalwareS0154
BloodHoundToolS0521
esentutlToolS0404
MimikatzToolS0002
NetToolS0039
PsExecToolS0029