H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)

65 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

Tool

uses

to Browser Information Discovery

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Cobalt Strike

Malware

uses

to Command Obfuscation

Technique

uses

Technique

uses

to Credential Stuffing

Technique

uses

to Data from Network Shared Drive

Technique

uses

to DLL

Technique

uses

to DNS

Technique

uses

to Domain Account

Technique

uses

to Domain Accounts

Technique

uses

to Domain Controller Authentication

Technique

uses

to Domain Trust Discovery

Technique

uses

Tool

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration to Cloud Storage

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Local Email Collection

Technique

uses

to Local Groups

Technique

uses

to Local Storage Discovery

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

to Multi-Factor Authentication Interception

Technique

uses

Technique

uses

to Net

Tool

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

Technique

uses

to Pass the Hash

Technique

uses

to Password Policy Discovery

Technique

uses

to Password Spraying

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Protocol Tunneling

Technique

uses

Tool

uses

to Query Registry

Technique

uses

to Remote Data Staging

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote Email Collection

Technique

uses

to Remote System Discovery

Technique

uses

to Scheduled Task

Technique

uses

to Service Execution

Technique

uses

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

to System Time Discovery

Technique

uses

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Remote Management

Technique

4 external

References

mitre-attack

G0114

Chimera

—

Cycraft Chimera April 2020

https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf

NCC Group Chimera January 2021

https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/