Axiom

Origin🇨🇳 China

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

State sponsor: ChinaAttribution confidence: 50%Target categories: Government, Private sector, Civil society

Targeted regions: United States · Netherlands · Italy · Japan · United Kingdom · Belgium · Russia · Indonesia · Germany · Switzerland +1

Also known as:AURORA PANDABRONZE KEYSTONEDogfishG0001G0025Group 72Group 8HELIUMHeart TyphoonHidden LynxTailgater Team

About the group

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity60

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

DNS Server Virtual Private Server Botnet

Initial access

Drive-by Compromise Exploit Public-Facing Application Phishing

Execution

Exploitation for Client Execution

Privilege escalation

Accessibility Features

Credential access

OS Credential Dumping

Lateral movement

Remote Desktop Protocol RDP Hijacking

Collection

Data from Local System Archive Collected Data

Command and control

Steganography

defense-impairment

Subvert Trust Controls

stealth

Valid Accounts

Exploited vulnerabilities 6

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2013-3893HIGHEPSS 88%KEV MITRE ATT&CK

CVE-2014-0322HIGHEPSS 85%KEV MITRE ATT&CK

CVE-2012-1889HIGHEPSS 84%KEV MITRE ATT&CK

CVE-2012-4792HIGHEPSS 79%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

Known infrastructure 6

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash7353d8c8cbfa5381e556c58370e0f3e6bc0e87f80c0d68578a014f9c34ef681fGh0stRATmalwarebazaar

sha256_hash8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8Gh0stRATmalwarebazaar

sha256_hash2f4f3bce4e588901683edc36575b14e829d70007673a001e13ab9d7d18c6fa8fGh0stRATmalwarebazaar

sha256_hash96c0911c225219cfd380076f5196d7ee87c617cddb968d3d465122473e20d6fbGh0stRATmalwarebazaar

sha256_hash0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dGh0stRATmalwarebazaar

sha256_hash69e2433df06b829e98e5a6c8f552b9371795fb65df62fa4cfb7362970d1ce744Gh0stRATmalwarebazaar

References

Axiom uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →