Chimera has used

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|

Chimera has dumped password hashes for use in pass the hash authentication attacks.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Chimera has used HTTPS for C2 communications.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Chimera has used

PsExec to deploy beacons on compromised systems.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

Chimera has used

Cobalt Strike to encapsulate C2 in DNS traffic.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Chimera has used side loading to place malicious DLLs in memory.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Chimera has staged stolen data locally on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|

Chimera has harvested data from victim's e-mail including through execution of

Chimera has harvested data from remote mailboxes including through execution of