Home/ Threat Actors/ Chimera

🌐Chimera

🌐 Chimera is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: Unknown. We map 14 detection use cases to this actor across 59 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G0114) ↗

14Use cases

0Articles

59Techniques

0IOCs

About this actor (MITRE)

[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)

Known aliases

Chimera

Top techniques

T1003.003 · NTDS T1007 · System Service Discovery T1012 · Query Registry

All other tracked techniques

T1016 · System Network Configuration Discovery T1018 · Remote System Discovery T1021.001 · Remote Desktop Protocol T1021.002 · SMB/Windows Admin Shares T1021.006 · Windows Remote Management T1027.010 · Command Obfuscation T1033 · System Owner/User Discovery T1036.005 · Match Legitimate Resource Name or Location T1039 · Data from Network Shared Drive T1041 · Exfiltration Over C2 Channel T1046 · Network Service Discovery T1047 · Windows Management Instrumentation T1049 · System Network Connections Discovery T1053.005 · Scheduled Task T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1069.001 · Local Groups T1070.004 · File Deletion T1070.006 · Timestomp T1071.001 · Web Protocols T1071.004 · DNS T1074.001 · Local Data Staging T1074.002 · Remote Data Staging T1078 · Valid Accounts T1078.002 · Domain Accounts T1083 · File and Directory Discovery T1087.001 · Local Account T1087.002 · Domain Account T1105 · Ingress Tool Transfer T1106 · Native API T1110.003 · Password Spraying T1110.004 · Credential Stuffing T1111 · Multi-Factor Authentication Interception T1114.001 · Local Email Collection T1114.002 · Remote Email Collection T1119 · Automated Collection T1124 · System Time Discovery T1133 · External Remote Services T1135 · Network Share Discovery T1201 · Password Policy Discovery T1213.002 · Sharepoint T1217 · Browser Information Discovery T1482 · Domain Trust Discovery T1550.002 · Pass the Hash T1556.001 · Domain Controller Authentication T1560.001 · Archive via Utility T1567.002 · Exfiltration to Cloud Storage T1569.002 · Service Execution T1570 · Lateral Tool Transfer T1572 · Protocol Tunneling T1574.001 · DLL T1588.002 · Tool T1589.001 · Credentials T1680 · Local Storage Discovery T1685.005 · Clear Windows Event Logs

Detection use cases (14)

Chimera 'Skeleton Key' DC authentication patching via Mimikatz on domain controllers (Operation Skeleton Key) AI · profile SΣ Chimera staged exfiltration — 7-Zip multipart archive on a DC/file share followed by cloud-storage egress AI · profile S 1Password impossible-travel sign-in MITRE match Auth-Bypass on Public-Facing Service → Post-Exploit Action on Same Host (≤10 min) MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Edge-service post-exploitation chain: internet-facing daemon → child shell or token redemption within 10 min of external request MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access MITRE match