Chimera
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Targets
Regions: Taiwan
Source: MITRE ATT&CKKnown techniques
- T1003.003NTDS
- T1007System Service Discovery
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.001Remote Desktop Protocol
- T1021.002SMB/Windows Admin Shares
- T1021.006Windows Remote Management
- T1027.010Command Obfuscation
- T1033System Owner/User Discovery
- T1036.005Match Legitimate Resource Name or Location
- T1039Data from Network Shared Drive
- T1041Exfiltration Over C2 Channel
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1057Process Discovery
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1069.001Local Groups
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1071.004DNS
- T1074.001Local Data Staging
- T1074.002Remote Data Staging
- T1078Valid Accounts
- T1078.002Domain Accounts
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1105Ingress Tool Transfer
- T1106Native API
- T1110.003Password Spraying
- T1110.004Credential Stuffing
- T1111Multi-Factor Authentication Interception
- T1114.001Local Email Collection
- T1114.002Remote Email Collection
- T1119Automated Collection
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.