MITRE ATT&CKgroup

G0128 ZIRCONIUM

Published 2021-03-24 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
APT31, Violet Typhoon
Version
2.3
Created
2021-03-24

Description

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

Related

Uses · MITRE ATT&CK (29)

  • T1584.008 Network Devices sub-technique
  • T1665 Hide Infrastructure technique
  • T1598 Phishing for Information technique
  • T1598.003 Spearphishing Link sub-technique
  • T1583.006 Web Services sub-technique
  • T1583.001 Domains sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.006 Python sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1027.002 Software Packing sub-technique
  • T1218.007 Msiexec sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1068 Exploitation for Privilege Escalation technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1124 System Time Discovery technique

References