ChessMaster
ChessMaster is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 3 sectors, including Government, and Education and Research, in Japan. It uses 13 MITRE ATT&CK techniques.
- Techniques
- 13
- Exploited CVEs
- No CVE data
- First seen
- Mar 29, 2018
- Last seen
- Mar 29, 2018
- Record updated
Who They Target.
Countries · 1
How They Operate · MITRE ATT&CK.
13 techniques across 5 of 14 tacticsResource Development·
Execution6
T1055
Process Injection
Process Injection
T1059.001
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: PowerShell
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
T1059.007
Command and Scripting Interpreter: JavaScript
Command and Scripting Interpreter: JavaScript
T1140
Deobfuscate/Decode Files or Information
Deobfuscate/Decode Files or Information
T1574.002
Hijack Execution Flow: DLL Side-Loading
Hijack Execution Flow: DLL Side-Loading
Persistence·
Privilege Escalation·
Defense Evasion2
T1218.005
System Binary Proxy Execution: Mshta
System Binary Proxy Execution: Mshta
T1553.002
Subvert Trust Controls: Code Signing
Subvert Trust Controls: Code Signing
Credential Access1
T1003
OS Credential Dumping
OS Credential Dumping
Discovery·
Lateral Movement·
Collection·
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- UPPERCUTmalware
- certutiltool
- Koadictool
Campaigns.
- ChessMasterMar 2018
- ChessMaster Cyberespionage CampaignNov 2017
Indicators Of Compromise.
TLP:AMBER22 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout ChessMaster.
A sophisticated cyberespionage threat group active since at least July 2017, heavily focused on targeting organizations in Japan.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.