Chimera

Summary

Suspected China-based espionage group (MITRE G0114) after intellectual property and personal data. CyCraft named it in 2020 for intrusions into Taiwan's semiconductor industry (Operation Skeleton Key); in 2021 NCC Group and Fox-IT described a closely matching actor stealing airline passenger data. Sophos CTU, which tracks it as BRONZE VAPOR, dates it to at least 2017 and adds a European aviation victim (2019) and a European semiconductor company. Its playbook is distinctive in aggregate: logging in to VPN, Citrix and other remote services with valid, sprayed or stuffed credentials (T1133, T1110.003), Cobalt Strike tunnelled over DNS and HTTPS (T1572), pass-the-hash (T1550.002), WinRAR or modified RAR archives (T1560.001), and exfiltration to OneDrive and Google Drive with its WATERCYCLE tool (T1567.002). Sophos also lists AceHash for credential harvesting and STOCKPIPE for proxying data through Exchange over email. Sophos maps Microsoft's Tumbleweed Typhoon (THORIUM, DEV-0039) to this group; Microsoft's own naming table does not name Chimera, so those names are not used for matching. last_seen is the latest dated activity in the readable sources (2019); the NCC Group report is no longer reachable at its URL.

Attribution

MITRE: suspected China-based; CyCraft: China-linked; Sophos CTU: moderate confidence

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Suspected China-based threat group
• Sophos CTU (Research, 2026-10)
  Based in China (moderate confidence)

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 3

Infrastructure patterns

• C2 on Azure and Appspot subdomains, plus own "sync"- or "update"-themed domains (Sophos CTU, 2026)

Reporting and advisories 4

• MITRE ATT&CK
  Chimera (G0114)
• CyCraft
  APT group Chimera — Operation Skeleton Key targets Taiwan semiconductor vendors (2020)
• CyCraft
  Threat attribution — Chimera "Under the Radar" (Jan 2021)
• Sophos CTU
  BRONZE VAPOR threat profile