Loading threat actor…
Axiom, also tracked as Group 72, is a Chinese cyber-espionage threat actor associated with long-running intrusions against government, technology, and other strategic targets. The group has been linked in public reporting to the broader Chinese intrusion ecosystem and is known for using a mix of custom and commodity malware families, including Derusbi, HiKit, PlugX, ZXShell, Ghost RAT, 9002 RAT, and BLACKCOFFEE. Axiom has also been connected to the Operation SMN intrusion set. The actor is known to gain access by exploiting public-facing applications and deploying server-side persistence such as web shells and IIS components. Post-compromise activity includes command execution, credential dumping, use of Remote Desktop Protocol during operations, collection of data from compromised networks, and use of virtual private server infrastructure to support targeting and operations. Reporting has also noted code overlap between tooling used in the CCleaner supply-chain compromise and malware associated with APT17/Group 72, although such overlap alone is not definitive attribution. Axiom is best characterized as a state-linked espionage actor focused on stealthy network compromise, persistence on internet-facing systems, credential access, and follow-on collection from victim environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
50 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
14 malware families attributed to this actor across reporting.
9 additional families tracked in Mallory.
12 CVEs this actor has used in observed campaigns. 12 of them exploited in the wild.
Axiom has used exploits for multiple vulnerabilities including... CVE-2012-1889...
Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792...
Axiom has used exploits for multiple vulnerabilities including... CVE-2013-3893.
Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322...
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
7 more CVEs tied to this actor tracked in Mallory.
25 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only in ATT&CK annotation context; no actor-specific activity is discussed.
Listed as an associated threat actor in the detection annotation for a Linux usermod root UID set analytic; no specific campaign or activity is described in this reference.
Listed as an associated threat actor in detection annotations for Ghostscript exploitation; no specific campaign activity is described in this reference.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.