S0672: Zox

Zox is a Windows remote access tool in ATT&CK, associated through MITRE relationships with Axiom and a set of behaviors that matter for post-compromise operations: command and control hiding, local discovery, file collection, tool transfer, SMB-based lateral movement, and possible privilege escalation. For leaders, the value is not the malware name alone; it is a checklist for whether Windows endpoint, network, SMB, and vulnerability-management controls can prove visibility across an intrusion lifecycle.

Executive priority

Treat this as a resilience and assurance question: can the organization detect and investigate a Windows remote access tool that discovers local data, moves through SMB/admin shares, transfers additional tooling, and obscures command-and-control activity? Priority should be higher for environments where Axiom-relevant sectors or sensitive intellectual property are material, but local exposure must be validated with asset, identity, and telemetry evidence rather than assumed from ATT&CK alone.

Technical view

ATT&CK does not provide official detection text for Zox, so SOC and IR teams should validate coverage through the related techniques: T1001.002 Steganography, T1005 Data from Local System, T1021.002 SMB/Windows Admin Shares, T1027.013 Encrypted/Encoded File, T1057 Process Discovery, T1068 Exploitation for Privilege Escalation, T1083 File and Directory Discovery, T1105 Ingress Tool Transfer, and T1680 Local Storage Discovery. Because the malware platform is listed as Windows, prioritize Windows host telemetry and correlate it with SMB authentication/share access and outbound network activity that may include unusual file-based or encoded content transfers.

Likely telemetry

Windows endpoint process execution and parent/child process activity related to discovery commands or utilities
File system access, file enumeration, and local data staging indicators
Local drive, disk, and volume enumeration evidence
SMB/admin share authentication, remote share access, and lateral file movement logs
Network egress metadata for command-and-control-like sessions and transferred files

Detection direction

Do not rely on a Zox signature alone; validate behavior-based detections across discovery, collection, SMB movement, ingress tool transfer, and obfuscated or encoded files.
Tune SMB/admin share detections against administrative baselines to reduce false positives while still alerting on unusual source hosts, accounts, timing, or share paths.
Review whether network monitoring can surface suspicious file transfers or steganography-like patterns; ATT&CK notes this behavior can make C2 detection harder, so absence of alerts is not proof of absence.
Correlate process and file discovery with later network transfer or SMB activity to distinguish benign administration from intrusion progression.
Because official ATT&CK detection guidance is not provided, use local baselines, incident history, and controlled validation to determine whether current EDR/SIEM logic is adequate.

Mitigation priorities

Prioritize least-privilege access and tight control of Windows administrative shares and accounts used for SMB access.
Maintain vulnerability management and patching discipline for privilege-escalation exposure referenced by T1068.
Ensure Windows endpoint detection, file auditing where appropriate, and network egress monitoring are retained long enough for incident reconstruction.
Restrict and monitor tool transfer paths, especially external downloads and movement of executables or encoded files inside the environment.
Prepare IR playbooks that connect remote access, discovery, collection, SMB movement, and C2 investigation rather than treating each alert as isolated.

Additional notes and limits

The most decision-relevant context is the combination of a Windows RAT, its association with Axiom in ATT&CK, and its linked techniques spanning command and control, discovery, collection, lateral movement, privilege escalation, stealth, and tool transfer. This supports a control-validation discussion across SOC, IR, identity, endpoint, network, and vulnerability-management teams.

The supplied ATT&CK object is sparse: Zox has no official detection text, no object-level tactics listed, and only Windows is specified as the malware platform. Related technique platform lists are broader and should not be interpreted as Zox platform support. No claim is made here about current active exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Zox

Zox is a remote access tool that has been used by Axiom since at least 2008.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques9 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Zox has been encoded with Base64.[1]
Enterprise	T1001.002	SteganographySub-technique	Zox has used the .PNG file format for C2 communications.[1]
Enterprise	T1105	Ingress Tool Transfer	Zox can download files to a compromised machine.[1]
Enterprise	T1083	File and Directory Discovery	Zox can enumerate files on a compromised host.[1]
Enterprise	T1021.002	SMB/Windows Admin SharesSub-technique	Zox has the ability to use SMB for communication.[1]
Enterprise	T1005	Data from Local System	Zox has the ability to upload files from a targeted system.[1]
Enterprise	T1057	Process Discovery	Zox has the ability to list processes.[1]
Enterprise	T1068	Exploitation for Privilege Escalation	Zox has the ability to leverage local and remote exploits to escalate privileges.[1]
Enterprise	T1680	Local Storage Discovery	Zox can enumerate attached drives.[1]

Associated objects

Groups, software, and campaigns

G0001: Axiom

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1027.013: Encrypted/Encoded FileEnterprise uses · TechniqueT1001.002: SteganographyEnterprise uses · GroupG0001: AxiomEnterprise uses · TechniqueT1105: Ingress Tool TransferEnterprise uses · TechniqueT1083: File and Directory DiscoveryEnterprise uses · TechniqueT1021.002: SMB/Windows Admin SharesEnterprise uses · TechniqueT1005: Data from Local SystemEnterprise uses · TechniqueT1057: Process DiscoveryEnterprise uses · TechniqueT1068: Exploitation for Privilege EscalationEnterprise uses · TechniqueT1680: Local Storage DiscoveryEnterprise

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.1
Created: Jan 9, 2022, 22:02 UTC (UTC+00:00)
Modified: Apr 10, 2024, 20:30 UTC (UTC+00:00)
Raw hash: 98dfa6c77ffd993c...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 10, 2024, 20:30 UTC (UTC+00:00)	Current bundle	`98dfa6c77ffd…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[2]
Gresim
(Citation: Novetta-Axiom)
[3]
Gresim
(Citation: Novetta-Axiom)
[4]
Gresim
(Citation: Novetta-Axiom)
[5]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[6]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[7]
ZoxPNG
(Citation: Novetta-Axiom)
[8]
ZoxPNG
(Citation: Novetta-Axiom)
[9]
ZoxPNG
(Citation: Novetta-Axiom)
[10]
ZoxRPC
(Citation: Novetta-Axiom)
[11]
ZoxRPC
(Citation: Novetta-Axiom)
[12]
ZoxRPC
(Citation: Novetta-Axiom)
[13]
mitre-attackS0672
Open source URL
[14]
mitre-attackS0672
Open source URL
[15]
mitre-attackS0672
Open source URL
[16]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[17]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[18]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[19]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[20]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[21]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[22]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[23]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[24]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[25]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[26]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[27]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[28]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[29]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[30]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[31]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[32]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[33]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[34]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL
[35]
Novetta-Axiom
Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use