Axiom

Introduction

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting. Kaspersky Winnti April 2013 Kaspersky Winnti June 2015 Novetta Winnti April 2015

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1001.002 Steganography
• T1005 Data from Local System
• T1560 Archive Collected Data
• T1584.005 Botnet
• T1189 Drive-by Compromise
• T1553 Subvert Trust Controls
• T1021.001 Remote Desktop Protocol
• T1583.002 DNS Server
• T1203 Exploitation for Client Execution
• T1078 Valid Accounts
• T1583.003 Virtual Private Server
• T1563.002 RDP Hijacking
• T1546.008 Accessibility Features
• T1566 Phishing
• T1190 Exploit Public-Facing Application
• T1003 OS Credential Dumping

ATT&CK technique IDs (denormalized)

• T1001.002
• T1003
• T1005
• T1021.001
• T1078
• T1189
• T1190
• T1203
• T1546.008
• T1553
• T1560
• T1563.002
• T1566
• T1583.002
• T1583.003
• T1584.005

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• ZxShell (S0412) — malware
• gh0st RAT (S0032) — malware
• Zox (S0672) — malware
• PlugX (S0013) — malware
• Hikit (S0009) — malware
• PoisonIvy (S0012) — malware
• Derusbi (S0021) — malware
• Hydraq (S0203) — malware

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [4] Cisco Group 72 Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016. [5] Kaspersky Winnti April 2013 Kaspersky Lab’s Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017. [6] Novetta Winnti April 2015 Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017. [7] Novetta-Axiom Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014. [8] Kaspersky Winnti June 2015 Tarakanov, D. (2015, June 22). Games are over: Winnti is now targeting pharmaceutical companies. Retrieved January 14, 2016.