aol.pm

Axiom

IntrusionSet · ATTACK:enterprise:G0001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0001",
  "title": "Axiom",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--a0cb9370-e39b-44d5-9f50-ef78e412b973",
  "external_id": "G0001",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:45.629Z",
  "modified": "2026-07-31T18:48:11.488Z",
  "version": "2.0",
  "aliases": [
    "Axiom",
    "Group 72"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Group 72"
    },
    {
      "source_name": "Axiom"
    },
    {
      "source_name": "Cisco Group 72",
      "url": "http://blogs.cisco.com/security/talos/threat-spotlight-group-72"
    },
    {
      "source_name": "Kaspersky Winnti April 2013",
      "url": "https://securelist.com/winnti-more-than-just-a-game/37029/"
    },
    {
      "source_name": "Novetta Winnti April 2015",
      "url": "https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    },
    {
      "source_name": "Kaspersky Winnti June 2015",
      "url": "https://securelist.com/games-are-over/70991/"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1001.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c393451-a750-4c8a-81be-4d0e9e84a6eb

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--161c58eb-29d7-4de3-aca8-3bda085f19a3

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0412

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aee1049-89be-45b8-ae2f-83bf4e35d5a3

Talos ZxShell Oct 2014 · Cisco Group 72

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2202d670-a6f3-42eb-ae1b-1ae615c3b620

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1584.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--324a715b-5d89-41a1-957e-3214badee119

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37880f36-c47a-4d1f-aedf-bb7d9fb2fd9f

Cisco Group 72

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0032

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f8411e1-71c2-46da-a789-9403c4b1f967

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0672

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5329433a-2e84-4f56-b933-01620892e333

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ee26367-1517-4fda-9dbe-8f9e63cc01eb

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1553

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64aa92d9-abdb-494c-8646-8548aa7c25a5

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70f3eaca-179d-4412-ad32-c4e3cf60c27c

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1583.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a51cf35-ac6e-4954-8864-8aa48a4bebbf

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ab16f65-9be6-46ec-8c2c-96f58e089df0

Cisco Group 72

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a83df94-30d3-4d4b-94c0-d988e3fcfc33

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1583.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a12a296d-3cdb-4a49-840a-4ecd073b5312

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1563.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a78310c3-ee57-465a-9983-13c6a7cd1d4f

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8122755-90fe-4b68-8fa1-55ed7be90931

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abe1a402-9ad5-43d0-9e5d-cabe4269fc06

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9f4c6ef-d0bd-4651-9445-4705e1fd85f2

Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1566

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d738cc0a-6d6f-41d9-88d0-9fe83bacad55

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e11a3d87-d9cf-4dcf-b722-fef4b0a324b4

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4c7c4b7-fe19-4433-acd9-ec94f436f381

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0094ba8-a513-49bf-a5d7-961aaab13380

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fad2a504-6e00-4892-bf88-b49d6d18788c

Novetta-Axiom

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.