Chimera - G0114

Created: 2020-08-24T17:01:55.842Z

Modified: 2023-03-22T03:25:24.295Z

Contributors:

Aliases

Chimera

Description

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)

Techniques Used

Chimera has obtained and used tools such as

BloodHound,

Cobalt Strike,

Mimikatz, and

PsExec.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Chimera has performed file deletion to evade detection.(Citation: Cycraft Chimera April 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Chimera has encapsulated

Cobalt Strike's C2 protocol in DNS and HTTPS.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Chimera has collected data of interest from network shares.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Chimera has used

Chimera has used

Chimera has used the

Chimera has used

ipconfig,

Ping, and

Chimera has used

Chimera has used

Chimera has queried Registry keys using

Chimera has used

Chimera has used custom DLLs for continuous retrieval of data from memory.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Chimera has used