- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2018–2026
- Status
- Active
- ATT&CK
- G0114 · 59 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0118 · chimera
ChinaWhat it is
Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Tumbleweed Typhoon
- MITRE ATT&CK
- G0114
- PwC
- Red Charon
- Operations
- Operation “Skeleton Key”
- Other names
- BRONZE VAPOR, Karst, Nuclear Taurus, Pashka, Quimera Crypter, THORIUM
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Netherlands, Taiwan
- Sectors
- Aviation, High-Tech, Semiconductor Industry
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Back Orifice
- Back Orifice 2000
- BloodHound
- China Chopper
- ClientMesh
- CloudDuke
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Mimikatz
- Net
- PsExec
- Remote Utilities
- RemoteCMD
- RemotePC
- SharpBot
- SharpEye
- Skeleton Key
- esentutl
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de