Procedure examples

Axiom has used steganography to hide its C2 communications.

Axiom has been known to dump credentials.

Axiom has collected data from a compromised network.

Axiom has used RDP during operations.

Axiom has used previously compromised administrative accounts to escalate privileges.

Axiom has used watering hole attacks to gain access.

Axiom has been observed using SQL injection to gain access to systems.

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.

Axiom has used digital certificates to deliver malware.

Axiom has compressed and encrypted data prior to exfiltration.

Axiom has targeted victims with remote administration tools including RDP.

Axiom has used spear phishing to initially compromise victims.

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.

Axiom has used VPS hosting providers in targeting of intended victims.

Axiom has used large groups of compromised machines for use as proxy nodes.