Chimera has harvested data from victim's e-mail including through execution of

Chimera has harvested data from remote mailboxes including through execution of

Chimera has collected documents from the victim's SharePoint.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Chimera has copied tools between compromised hosts using SMB.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.006|Windows Remote Management|

Chimera has used WinRM for lateral movement.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Chimera has used the

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Chimera has used

Chimera has cleared event logs on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Chimera has used a Windows version of the Linux

Chimera has used

Chimera has exfiltrated stolen data to OneDrive accounts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Chimera has staged stolen data on designated servers in the target environment.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Chimera has used