Axiom

First seen

2008-01-01 00:00:00

Primary motivation

espionage

Sophistication

advanced

Resource level

government

Actor type

nation-state

Related IoCs

84 (42 malicious)

Last IoC activity

2026-09-02 00:39:19

Profile updated

2026-07-07 11:47:27

Targeted industries: defense-and-aerospace government-and-public-sector manufacturing media-and-entertainment

Context

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.

Recent IoC activity

42 malicious indicators in Maltiverse are attributed to Axiom (G0001). The 20 most recently updated:

Detection coverage

• 17 YARA rules
• 206 Sigma rules

Malware & tools used

• Steganography (attack-pattern)
• Data from Local System (attack-pattern)
• Archive Collected Data (attack-pattern)
• Botnet (attack-pattern)
• Drive-by Compromise (attack-pattern)
• Subvert Trust Controls (attack-pattern)
• Remote Desktop Protocol (attack-pattern)
• DNS Server (attack-pattern)
• Exploitation for Client Execution (attack-pattern)
• Valid Accounts (attack-pattern)
• Virtual Private Server (attack-pattern)
• RDP Hijacking (attack-pattern)
• Accessibility Features (attack-pattern)
• Phishing (attack-pattern)
• Exploit Public-Facing Application (attack-pattern)
• OS Credential Dumping (attack-pattern)
• PlugX (malware)
• Hydraq (malware)
• gh0st RAT (malware)
• Derusbi (malware)
• Hikit (malware)
• PoisonIvy (malware)
• ZxShell (malware)
• Zox (malware)

Related threat objects

• APT17 (threat-actor)

Reports & references

• MITRE ATT&CK — G0001 (report)
• Kaspersky — 37029 (report)
• Kaspersky — 70991 (report)
• web.archive.org — Novetta Winntianalysis (report)
• blogs.cisco.com — Threat Spotlight Group 72 (report)
• web.archive.org — Executive Summary Final 1 (report)

External references

• mitre-attack — G0001
• Group 72
• Axiom
• Cisco Group 72
• Kaspersky Winnti April 2013
• Novetta Winnti April 2015
• Novetta-Axiom
• Kaspersky Winnti June 2015
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy