Axiom
- ID
- G0001
- Associated names
- Group 72
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]
Techniques used (16)
- T1001.002 Steganography
- T1003 OS Credential Dumping
- T1005 Data from Local System
- T1021.001 Remote Desktop Protocol
- T1078 Valid Accounts
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1546.008 Accessibility Features
- T1553 Subvert Trust Controls
- T1560 Archive Collected Data
- T1563.002 RDP Hijacking
- T1566 Phishing
- T1583.002 DNS Server
- T1583.003 Virtual Private Server
- T1584.005 Botnet