Chimera

Chimera is a threat actor tracked in the provided content under the name Chimera. The content describes Chimera staging stolen data locally on compromised hosts and on designated servers in the target environment, then exfiltrating stolen data via Cobalt Strike C2 beacons and to OneDrive accounts. Chimera has used the Windows Command Shell and batch scripts for execution, PowerShell scripts to execute malicious payloads, and the DSInternals PowerShell module to make use of Active Directory features. For remote execution, lateral activity, and persistence, Chimera has used WMIC to execute remote commands and scheduled tasks to invoke Cobalt Strike and maintain persistence, including creation of tasks running as SYSTEM. The actor has obtained and used tools including BloodHound, Cobalt Strike, Mimikatz, and PsExec. Discovery activity in the content includes use of tasklist to enumerate processes, reg query against HKU\SOFTWARE\Microsoft\Terminal Server Client\Servers and HKU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, bookmark discovery using paths matching Citrix-related imported IE bookmarks, and network scanning using the get -b -e -p command and a custom Python-based Windows executable named Get.exe to scan IP ranges for HTTP services. Defense evasion behaviors described include file deletion to evade detection, timestomping DLLs using a Windows version of the Linux touch command, and renaming malware and tools to benign-looking names such as GoogleUpdate.exe, jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe. No additional aliases or sub-groups are provided beyond Chimera.