- Category
- State · Attributed to a state or working for one.
- Origin
- China(medium confidence)
- Sponsor
- State-sponsored
- Motivation
- Information theft and espionage
- Seen
- 2008–2026
- Status
- Active
- ATT&CK
- G0001 · 16 techniques
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0488 · axiom
ChinaWhat it is
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0001
- Talos and others
- Group 72
- Operations
- Operation “SMN”
- Other names
- Axiom, Group 72
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
Targets
- Countries
- Japan, South Korea, Taiwan, United States
- Sectors
- Aerospace, Defense, Industrial, Manufacturing, Media
Tools
The tools and malware families the sources tie to it.
- Derusbi
- Hikit
- Hydraq
- PlugX
- PoisonIvy
- Zox
- ZxShell
- gh0st RAT
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th