G0001 · 17 ATT&CK techniques · 0 correlated reports

Axiom

Aliases: Group 72

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.

Open interactive actor investigation

ATT&CK techniques

T1001.002
Steganography T1005
Data from Local System T1560
Archive Collected Data T1584.005
Botnet T1189
Drive-by Compromise T1553
Subvert Trust Controls T1021.001
Remote Desktop Protocol T1583.002
DNS Server T1203
Exploitation for Client Execution T1078
Valid Accounts T1583.003
Virtual Private Server T1563.002
RDP Hijacking T1546.008
Accessibility Features T1566
Phishing T1190
Exploit Public-Facing Application T1003
OS Credential Dumping T1001
Data Obfuscation

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research