Chimera
- ID
- G0114
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.[1][2]
Techniques used (59)
- T1003.003 NTDS
- T1007 System Service Discovery
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.006 Windows Remote Management
- T1027.010 Command Obfuscation
- T1033 System Owner/User Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1069.001 Local Groups
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1071.004 DNS
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1110.003 Password Spraying
- T1110.004 Credential Stuffing
- T1111 Multi-Factor Authentication Interception
- T1114.001 Local Email Collection
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1124 System Time Discovery
- T1133 External Remote Services
- T1135 Network Share Discovery
- T1201 Password Policy Discovery
- T1213.002 Sharepoint
- T1217 Browser Information Discovery
- T1482 Domain Trust Discovery
- T1550.002 Pass the Hash
- T1556.001 Domain Controller Authentication
- T1560.001 Archive via Utility
- T1567.002 Exfiltration to Cloud Storage
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1572 Protocol Tunneling
- T1574.001 DLL
- T1588.002 Tool
- T1589.001 Credentials
- T1680 Local Storage Discovery
- T1685.005 Clear Windows Event Logs