Threat Attribution — Chimera “Under the Radar”

Threat Attribution Research Comparison


  1. There is a strong probability the threat actor, CUTR, is Chimera as their IoCs, commonly used infra, tools, techniques, and behaviors are all very similar to Chimera; 42 of the 67 adversarial techniques used in both campaigns were identical.
  2. China-linked threat actors (e.g., Chimera, BlackTech, APT30) are known to share tools and attack methods with each other, making attribution challenging.
  3. Some differences in attack behavior may be due to differences in the victims’ architecture, security maturity, or geographic location (EU, not Taiwan). Different environments may require different TTP. TTP designed for infiltrating Taiwan’s semiconductor industry may require adjustment for the EU aviation industry and vice versa.
  4. Chimera was focused solely on the Taiwan semiconductor industry. CUTR showed “a wide set of interests,” including the EU semiconductor industry as well as aviation. While some China-linked threat actors have demonstrated an ability to adapt techniques, tools, and targets, sudden changes in attack behavior are not common — keeping true to the ideas behind Bianco’s Pyramid of Pain, as mentioned in the Fox-IT & NCC Group report. As TTPs are the hardest to change and tend to stay inflexible for longer periods of time, similar TTP usage between different attack campaigns/operations is a strong indicator of attribution.
Source — CyCraft Classroom: MITRE ATT&CK® vs. Cyber Kill Chain vs. Diamond Model

Hash Values

The following table shows the hash of these IoCs. As depicted in the table, 3 of the hashes are identical to our research. Even though the identical WinRAR and get.exe can be easily used by other threat actors, the added inclusion of the Cloud exfil tool increases the probability of Chimera attribution.


IP address & Domain Name

``None of the domain names are identical, but the behavior of abusing the cloud platforms such as Appspot or Azure Edge is aligned with our findings. This increases the probability of Chimera attribution.``

Network & Host Artifacts

Some file names used are similar to our research. Here we list some similar naming schemes.


The tools used by their threat actor significantly overlap with our research into Chimera.


According to the Pyramid of Pain model, TTP are the most difficult and less frequently changed methods of an attacker, suggesting that campaigns/operations with multiple similarities in TTP are most likely performed by the same threat actor.

Techniques critical to both Chimera & CUTR’s attack behavior:

Observed only in CUTR:

Observed only in Chimera:

Initial Access

T1133 External Remote Services
T1078 Valid Accounts


T1059.001 Command and Scripting Interpreter: PowerShell
T1059.003 Command and Scripting Interpreter: Windows Command Shell
T1053.005 Scheduled Task/Job: Scheduled Task
T1569.002 System Services: Service Execution
T1047 Windows Management Instrumentation


T1133 External Remote Services
T1078 Valid Accounts
T1574.002 Hijack Execution Flow: DLL Side-Loading

Privilege Escalation

T1078 Valid Accounts

Defense Evasion

T1140 Deobfuscate/Decode Files or Information
T1036.003 Masquerading: Rename System Utilities
T1036.005 Masquerading: Match Legitimate Name or Location
T1078 Valid Accounts
T1055.001 Process Injection: Dynamic-link Library Injection
T1070.001 Indicator Removal on Host: Clear Windows Event Logs
T1070.004 Indicator Removal on Host: File Deletion
T1070.006 Indicator Removal on Host: Timestomp
T1574.002 Hijack Execution Flow: DLL Side-Loading
T1550.002 Use Alternate Authentication Material: Pass the Hash

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory
T1003.003 OS Credential Dumping: NTDS
T1556.001 Modify Authentication Process: Domain Controller Authentication
T1110.003 Brute Force: Password Spraying
T1110.004 Brute Force: Credential Stuffing
T1111 Two-Factor Authentication Interception


T1087 Account Discovery
T1087.001 Account Discovery: Local Account
T1087.002 Account Discovery: Domain Account
T1083 File and Directory Discovery
T1135 Network Share Discovery
T1057 Process Discovery
T1012 Query Registry
T1082 System Information Discovery
T1016 System Network Configuration Discovery
T1033 System Owner/User Discovery
T1124 System Time Discovery
T1217 Browser Bookmark Discovery
T1482 Domain Trust Discovery
T1046 Network Service Scanning
T1069 Permission Groups Discovery
T1018 Remote System Discovery
T1049 System Network Connections Discovery
T1007 System Service Discovery

Lateral Movement

T1570 Lateral Tool Transfer
T1021.002 Remote Services: SMB/Windows Admin Shares
T1021.001 Remote Services: Remote Desktop Protocol
T1021.004 Remote Services: SSH
T1021.006 Remote Services: Windows Remote Management
T1550.002 Use Alternate Authentication Material: Pass the Hash


T1560.001 Archive Collected Data: Archive via Utility
T1119 Automated Collection
T1005 Data from Local System
T1074.001 Data Staged: Local Data Staging
T1074.002 Data Staged: Remote Data Staging
T1213.002 Data from Information Repositories: SharePoint
T1039 Data from Network Shared Drive
T1114.001 Email Collection: Local Email Collection

Command and Control

T1071.001 Application Layer Protocol: Web Protocols
T1071.004 Application Layer Protocol: DNS
T1573.002 Encrypted Channel: Asymmetric Cryptography
T1572 Protocol Tunneling


T1020 Automated Exfiltration
T1030 Data Transfer Size Limits
T1041 Exfiltration Over C2 Channel
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage


Threat attribution is difficult.

Everything Starts From Security

CyCraft Customers can prevent cyber intrusions from escalating into business-altering incidents. From endpoint to network, from investigation to blocking, from in-house to cloud, CyCraft AIR covers all aspects required to provide small, medium, and large organizations with the proactive, intelligent, and adaptable security solutions needed to defend from all manner of modern security threats with real-time protection and visibility across the organization.

Engage with CyCraft

Blog | LinkedIn | Twitter | Facebook | CyCraft

Related Resources



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
CyCraft Technology Corp

CyCraft automates SOC ops for the Fortune Global 500, national govs, & SMEs with MDR, IR, & threat hunting solutions. Learn more at