AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0001 · 17 ATT&CK techniques · 0 correlated reports

Axiom

Aliases: Group 72

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.

Open interactive actor investigation

ATT&CK techniques

T1001.002
Steganography T1005
Data from Local System T1560
Archive Collected Data T1584.005
Botnet T1189
Drive-by Compromise T1553
Subvert Trust Controls T1021.001
Remote Desktop Protocol T1583.002
DNS Server T1203
Exploitation for Client Execution T1078
Valid Accounts T1583.003
Virtual Private Server T1563.002
RDP Hijacking T1546.008
Accessibility Features T1566
Phishing T1190
Exploit Public-Facing Application T1003
OS Credential Dumping T1001
Data Obfuscation

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research