0attributed CVEs
82ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active
About this actor
[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
G0114
Unclassifiedno scheme matched
Chimera
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 82 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1003OS Credential Dumping ↗T1003.003NTDS ↗T1007System Service Discovery ↗T1012Query Registry ↗T1016System Network Configuration Discovery ↗T1018Remote System Discovery ↗T1021Remote Services ↗T1021.001Remote Desktop Protocol ↗T1021.002SMB/Windows Admin Shares ↗T1021.006Windows Remote Management ↗T1027Obfuscated Files or Information ↗T1027.010Command Obfuscation ↗T1033System Owner/User Discovery ↗T1036Masquerading ↗T1036.005Match Legitimate Resource Name or Location ↗T1039Data from Network Shared Drive ↗T1041Exfiltration Over C2 Channel ↗T1046Network Service Discovery ↗T1047Windows Management Instrumentation ↗T1049System Network Connections Discovery ↗T1053Scheduled Task/Job ↗T1053.005Scheduled Task ↗T1057Process Discovery ↗T1059Command and Scripting Interpreter ↗T1059.001PowerShell ↗T1059.003Windows Command Shell ↗T1069Permission Groups Discovery ↗T1069.001Local Groups ↗T1070Indicator Removal ↗T1070.004File Deletion ↗T1070.006Timestomp ↗T1071Application Layer Protocol ↗T1071.001Web Protocols ↗T1071.004DNS ↗T1074Data Staged ↗T1074.001Local Data Staging ↗T1074.002Remote Data Staging ↗T1078Valid Accounts ↗T1078.002Domain Accounts ↗T1083File and Directory Discovery ↗T1087Account Discovery ↗T1087.001Local Account ↗T1087.002Domain Account ↗T1105Ingress Tool Transfer ↗T1106Native API ↗T1110Brute Force ↗T1110.003Password Spraying ↗T1110.004Credential Stuffing ↗T1111Multi-Factor Authentication Interception ↗T1114Email Collection ↗T1114.001Local Email Collection ↗T1114.002Remote Email Collection ↗T1119Automated Collection ↗T1124System Time Discovery ↗T1133External Remote Services ↗T1135Network Share Discovery ↗T1201Password Policy Discovery ↗T1213Data from Information Repositories ↗T1213.002Sharepoint ↗T1217Browser Information Discovery ↗T1482Domain Trust Discovery ↗T1550Use Alternate Authentication Material ↗T1550.002Pass the Hash ↗T1556Modify Authentication Process ↗T1556.001Domain Controller Authentication ↗T1560Archive Collected Data ↗T1560.001Archive via Utility ↗T1567Exfiltration Over Web Service ↗T1567.002Exfiltration to Cloud Storage ↗T1569System Services ↗T1569.002Service Execution ↗T1570Lateral Tool Transfer ↗T1572Protocol Tunneling ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗T1588Obtain Capabilities ↗T1588.002Tool ↗T1589Gather Victim Identity Information ↗T1589.001Credentials ↗T1680Local Storage Discovery ↗T1685Disable or Modify Tools ↗T1685.005Clear Windows Event Logs ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 55 / 82 | 67% |
CM-6 | 53 / 82 | 65% |
CM-2 | 45 / 82 | 55% |
AC-3 | 40 / 82 | 49% |
AC-6 | 35 / 82 | 43% |
CM-7 | 35 / 82 | 43% |
AC-2 | 34 / 82 | 41% |
CA-7 | 31 / 82 | 38% |
SI-3 | 31 / 82 | 38% |
IA-2 | 30 / 82 | 37% |
AC-5 | 28 / 82 | 34% |
SI-7 | 25 / 82 | 30% |
CM-5 | 23 / 82 | 28% |
AC-4 | 22 / 82 | 27% |
SC-7 | 19 / 82 | 23% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- Operation Wocao 0.43
- Operation CuckooBees 0.37
- Ke3chang 0.36
- FIN13 0.34
- Wizard Spider 0.34
Same nation-state
- Night Dragon 1.00
- FunnyDream 1.00
- Operation Wocao 1.00
- C0017 1.00
- Cutting Edge 1.00
Same category
- Night Dragon 1.00
- FunnyDream 1.00
- C0011 1.00
- Operation Wocao 1.00
- Operation Dream Job 1.00