Chimera G0114

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1589.001 Credentials

Desenvolvimento de recursos

T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1569.002 Service Execution T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts T1133 External Remote Services T1556.001 Domain Controller Authentication

Escalada de privilégios

T1053.005 Scheduled Task T1078 Valid Accounts T1078.002 Domain Accounts

Furtividade

T1027.010 Command Obfuscation T1036.005 Match Legitimate Resource Name or Location T1070.004 File Deletion T1070.006 Timestomp T1078 Valid Accounts T1078.002 Domain Accounts T1574.001 DLL

Comprometimento de defesas

T1556.001 Domain Controller Authentication T1685.005 Clear Windows Event Logs

Acesso a credenciais

T1003.003 NTDS T1110.003 Password Spraying T1110.004 Credential Stuffing T1111 Multi-Factor Authentication Interception T1556.001 Domain Controller Authentication

Descoberta

T1007 System Service Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.001 Local Groups T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1124 System Time Discovery T1135 Network Share Discovery T1201 Password Policy Discovery T1217 Browser Information Discovery T1482 Domain Trust Discovery T1680 Local Storage Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.006 Windows Remote Management T1550.002 Pass the Hash T1570 Lateral Tool Transfer

Coleta

T1039 Data from Network Shared Drive T1074.001 Local Data Staging T1074.002 Remote Data Staging T1114.001 Local Email Collection T1114.002 Remote Email Collection T1119 Automated Collection T1213.002 Sharepoint T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer T1572 Protocol Tunneling

Exfiltração

T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

Malwares e ferramentas

Cobalt StrikeMalwareS0154
BloodHoundFerramentaS0521
esentutlFerramentaS0404
MimikatzFerramentaS0002
NetFerramentaS0039
PsExecFerramentaS0029