Chimera

Chimera is a China-based threat actor tracked as MITRE ATT&CK G0114 that has targeted organizations in Taiwan. Its operations combine credential-based remote access, Active Directory discovery, credential dumping, lateral movement, and scheduled-task persistence. Chimera has conducted password-spraying attacks against victims’ remote services to obtain valid user and administrator accounts and has used legitimate credentials to access external VPN, Citrix, SSH, and other remote services. Within compromised environments, Chimera uses scans and queries to identify domain controllers and remote services. Its toolset includes BloodHound, Cobalt Strike, Mimikatz, PsExec, and NtdsAudit. It has collected Active Directory database and SYSTEM registry data, extracted domain-user password hashes, and dumped hashes for pass-the-hash authentication. The group accesses systems through RDP and transfers tools between compromised hosts using SMB. Chimera uses Windows command shells, batch scripts, and encoded PowerShell commands for execution. It maintains persistence through scheduled tasks using valid accounts and has used tasks to invoke Cobalt Strike. It also archives collected data using gzip on Linux and modified RAR software on Windows.