Threat actor · all actors

AxiomG0001 state

aka Axiom, Group 72

Last updated: 2026-07-03

0attributed CVEs

22ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between [Axiom](https://attack.mitre.org/groups/G0001) and [Winnti Group](https://attack.mitre.org/groups/G0044) but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	16 / 22	73%
`CM-6`	14 / 22	64%
`AC-6`	12 / 22	55%
`CM-2`	12 / 22	55%
`SC-7`	11 / 22	50%
`AC-2`	10 / 22	45%
`AC-3`	10 / 22	45%
`AC-4`	10 / 22	45%
`CM-7`	9 / 22	41%
`SI-3`	9 / 22	41%
`CA-7`	8 / 22	36%
`CM-5`	8 / 22	36%
`AC-5`	7 / 22	32%
`CM-8`	7 / 22	32%
`IA-2`	7 / 22	32%

Co-occurring actors

None.

Similar actors

Similar TTPs

Agrius 0.18
Sea Turtle 0.17
C0032 0.16
APT1 0.16
Leviathan 0.16