File · Axiom · Unknown · refreshed 2026-10-18
attack rose · 16 techniques across 10 tactics
Analyst brief
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.
Observed targets (as stated by the sources)
1 countries · 0 sectorsassessed originnot stated by sourcesobserved targets · 1
countries · 1
- China
as stated by the cited sources, not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique16 techniques · 10 of 15 tactics
Resource development
3 techniquesInitial access
3 techniquesExecution
1 techniquePrivilege escalation
1 techniqueStealth
1 techniqueDefense impairment
1 techniqueCredential access
1 techniqueLateral movement
2 techniquesCollection
2 techniquesCommand and control
1 technique
select a technique
Arsenal
8 malwareas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Primary-source reports
linked, never re-hostedTake it with you
keyless · no signupReferences
6 sources- 1.attack.mitre.org/groups/G0001
- 2.blogs.cisco.com/security/talos/threat-spotlight-group-72
- 3.securelist.com/winnti-more-than-just-a-game/37029
- 4.web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/u…
- 5.web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/u…
- 6.securelist.com/games-are-over/70991
Track Axiom on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.