Axiom - G0001

Created: 2017-05-31T21:31:45.629Z

Modified: 2023-03-20T22:03:44.661Z

Contributors:

Aliases

Axiom,Group 72

Description

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)

Techniques Used

Axiom has collected data from a compromised network.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.002|DNS Server|

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

Axiom has used VPS hosting providers in targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Axiom has compressed and encrypted data prior to exfiltration.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1563.002|RDP Hijacking|

Axiom has targeted victims with remote administration tools including RDP.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|