THREAT_ACTOR · G0001
Axiom
Also known as: Axiom, Group 72
Profile
Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.
MITRE ATT&CK ↗Techniques
16 ATT&CK techniques attributed to this actor.
T1001.002 SteganographyT1003 OS Credential DumpingT1005 Data from Local SystemT1021.001 Remote Desktop ProtocolT1078 Valid AccountsT1189 Drive-by CompromiseT1190 Exploit Public-Facing ApplicationT1203 Exploitation for Client ExecutionT1546.008 Accessibility FeaturesT1553 Subvert Trust ControlsT1560 Archive Collected DataT1563.002 RDP HijackingT1566 PhishingT1583.002 DNS ServerT1583.003 Virtual Private ServerT1584.005 Botnet
Software
8 malware/tools attributed to this actor.
HikitPoisonIvyPlugXDerusbigh0st RATHydraqZxShellZox
Related corpus activity
8,351 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Axiom.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2023-52271 | cve | ransomware | 85 | 3 |
| cve-2025-11837 | cve | — | 85 | 2 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2026-3844 | cve | — | 85 | 1 |
| cve-2025-61155 | cve | ransomware | 85 | 3 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2013-3307 | cve | — | 85 | 2 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2025-34085 | cve | — | 85 | 1 |
| cve-2025-7852 | cve | — | 85 | 1 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2025-12057 | cve | — | 85 | 1 |
| cve-2016-5681 | cve | — | 85 | 2 |
| cve-2025-7443 | cve | — | 85 | 1 |
| cve-2025-1055 | cve | ransomware | 85 | 3 |
Showing the top 30 by severity of 8,351.