Operation Chimera

## Overview

Cycraft researchers (Jonghyun Cheng, Shonda Zhang, Diliang) disclosed "Operation Chimera," an APT campaign (2018-2019) targeting Taiwan and European semiconductor vendors with sophisticated espionage and intellectual property theft. Taiwan hosts critical semiconductor infrastructure: TSMC and MediaTek are global leaders; the sector represents a strategic asset for Taiwan's economy and global supply chains. Cycraft, a Taiwan-based security firm with regional offices, gained exceptional visibility into industry-wide attacks due to long-term partnerships with multiple semiconductor manufacturers. Between 2018-2019, researchers discovered coordinated targeting of 7+ vendors across Taiwan and Europe by the same actor group. The campaign evolved from single-enterprise attacks to supply-chain targeting to coordinated industry-wide operations—a novel threat pattern in the semiconductor sector. The group's name "Chimera" reflects their technique of merging multiple open-source tools (Dumper, Mimikatz, Cobalt Strike) into custom malware, similar to mythological chimeras combining different animal traits.

## Attack Scope and Operational Pattern

Investigation of 3+ vendors revealed 50+ compromised endpoints and 6+ compromised users. The attacker group operates with precise victim selection (not random), demonstrating knowledge of target organizations and their relationships (targeting subsidiaries and competitors alongside primary vendors). Initial access leverages Cobalt Strike beacons disguised as "Google Update," then deploys user backdoors also masquerading as Windows updates but customized per endpoint (different file hashes to evade detection signatures). Command-and-control communications route through public cloud providers (Google App Engine, Azure) to obscure attribution and complicate takedown. The campaign's objective diverges from financial cybercrime: attackers specifically target and exfiltrate documents, source code, software development kits (SDKs), and technical specifications of semiconductor chip projects—pure intellectual property theft. This strategic targeting indicates nation-state or nation-sponsored motivation.

## Operational Security and Adaptation

The campaign demonstrates sophisticated operational awareness. C2 infrastructure showed adaptive behavior: when initial Cobalt Strike beacons using Google Cloud Platform attracted attention, operators immediately changed cloud hosting providers and deployed fresh beacons within 24 hours to multiple endpoints. Investigation timeline varies by victim: Company A provided long-term monitoring allowing detailed threat actor activity tracking; Company B was incident response after compromise (attackers already gone), permitting analysis of stolen data and exfiltration scope; Company C's strong internal security team enabled collaborative deep forensic investigation. Coordinated industry-wide targeting across multiple geographic regions simultaneously, combined with rapid infrastructure adaptation and technical sophistication, indicates a capable, well-resourced attacker group prioritizing strategic IP acquisition over financial gain.