Chimera

Origin🇨🇳 China

Techniques (MITRE ATT&CK)59

SourceMITRE ATT&CK

Vexday analysis

Chimera é um grupo de ameaça persistente avançada (APT) com origem atribuída à China, ativo pelo menos desde 2018, com atuação documentada contra a indústria de semicondutores em Taiwan e dados do setor de aviação. Identificado no MITRE ATT&CK como G0114, o grupo possui 59 técnicas documentadas nessa base de conhecimento.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 59

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Credentials

Resource development

Tool

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Native API Service Execution

Persistence

External Remote Services

Credential access

NTDS Password Spraying Credential Stuffing Multi-Factor Authentication Interception

Discovery

System Service Discovery Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Process Discovery Local Groups File and Directory Discovery Local Account Domain Account System Time Discovery Network Share Discovery Password Policy Discovery Browser Information Discovery Domain Trust Discovery Local Storage Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares Windows Remote Management Pass the Hash Lateral Tool Transfer

Collection

Data from Network Shared Drive Local Data Staging Remote Data Staging Local Email Collection Remote Email Collection Automated Collection Sharepoint Archive via Utility

Command and control

Web Protocols DNS Ingress Tool Transfer Protocol Tunneling

Exfiltration

Exfiltration Over C2 Channel Exfiltration to Cloud Storage

defense-impairment

Domain Controller Authentication Clear Windows Event Logs

stealth

Command Obfuscation Match Legitimate Resource Name or Location File Deletion Timestomp Valid Accounts Domain Accounts DLL

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Known infrastructure 1527

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port45.221.118.46:80Cobalt Strikethreatfox

ip:port45.221.118.46:443Cobalt Strikethreatfox

ip:port38.76.183.197:8082Cobalt Strikethreatfox

ip:port8.222.188.173:443Cobalt Strikethreatfox

ip:port8.219.220.240:7777Cobalt Strikethreatfox

ip:port209.99.184.234:50050Cobalt Strikethreatfox

ip:port120.77.42.217:50000Cobalt Strikethreatfox

ip:port49.235.52.47:3000Cobalt Strikethreatfox

ip:port49.235.52.47:8080Cobalt Strikethreatfox

ip:port49.235.52.47:80Cobalt Strikethreatfox

ip:port49.235.52.47:443Cobalt Strikethreatfox

ip:port49.235.52.47:8083Cobalt Strikethreatfox

ip:port147.139.136.105:8080Cobalt Strikethreatfox

ip:port38.207.177.165:8080Cobalt Strikethreatfox

ip:port147.139.136.105:80Cobalt Strikethreatfox

ip:port147.139.136.105:22Cobalt Strikethreatfox

ip:port147.139.136.105:443Cobalt Strikethreatfox

ip:port2.57.241.129:80Cobalt Strikethreatfox

ip:port38.207.177.165:80Cobalt Strikethreatfox

ip:port38.207.177.165:443Cobalt Strikethreatfox

ip:port147.139.245.149:801Cobalt Strikethreatfox

ip:port45.221.118.46:8080Cobalt Strikethreatfox

ip:port119.45.198.250:55555Cobalt Strikethreatfox

ip:port118.24.42.214:443Cobalt Strikethreatfox

ip:port47.251.29.219:50050Cobalt Strikethreatfox

ip:port47.254.68.68:50050Cobalt Strikethreatfox

ip:port172.232.97.189:4444Cobalt Strikethreatfox

ip:port149.88.66.234:21Cobalt Strikethreatfox

ip:port47.108.86.120:22Cobalt Strikethreatfox

ip:port47.108.86.120:111Cobalt Strikethreatfox

+1527 indicators in total. See them all on the IOCs page.

Chimera uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →