Chimera

Chimera, also referred to in the content as APT Chimera, is a possible China-sponsored threat actor that CyCraft observed targeting Taiwan’s semiconductor industry in a year-long 2019 campaign. CyCraft also noted that highly malicious April 2020 intrusions against multiple Taiwan government agencies used techniques similar to APT Chimera, but stated that available evidence did not support direct attribution. The similarities suggested that China-based APT groups may share malware, tools, or techniques. Observed Chimera tradecraft in the provided content includes PowerShell execution, Windows command shell and batch-script execution, and remote execution via WMIC. The actor conducted discovery using file and directory listings, tasklist, quser, net user /dom, net user Administrator, ipconfig, ping, tracert, and registry queries including HKU\SOFTWARE\Microsoft\Terminal Server Client\Servers and HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings. Chimera also used a bookmark-discovery path pattern targeting Citrix-related browser artifacts. For credential access and post-compromise operations, Chimera used custom DLLs for continuous retrieval of data from memory and obtained or used tools including BloodHound, Cobalt Strike, Mimikatz, PsExec, and the DSInternals PowerShell module. For command and control and exfiltration, Chimera used HTTPS communications and Cobalt Strike beacons, and staged stolen data both locally on compromised hosts and on designated servers in the victim environment. Defense-evasion behavior included renaming malware to GoogleUpdate.exe and WinRAR to names including jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe; modifying DLL timestamps with a Windows version of the Linux touch command; and deleting files to evade detection.