Threat Actors ZIRCONIUM

ZIRCONIUM

G0128 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: APT31, Violet Typhoon, Hurricane Panda, Black Vine, TEMP.Avengers, Zirconium, JUDGMENT PANDA, BRONZE VINEWOOD, Red keres, TA412, zirconia, APT28, tracked as, zirconium dioxide, Head Mare, 21, 2026, Kyrgyzstan, Kazakhstan, defense industries, Awaken Likho, Bearlyfy, Librarian Ghouls, Librarian Likho, Rezet, Core Werewolf, Lone Wolf, Moonshine Trickster, Ratopak Spider, UAC-0008, Romania, Fancy Bear, UAC-0001, its NATO allies, Outrider Tiger, Fishing Elephant, Earth Vetala, MERCURY, Mango Sandstorm, Static Kitten, including diplomatic, maritime, financial, telecom entities, Archer RAT, RUSTRIC, detects installed security software, establishes contact with a, CHAR, Olalampo, Bloody Wolf, SkyCloak, laboo.boo, Clubfoot Wolf, Void Arachne, Watch Wolf, Forest Blizzard, TA450, MuddyWater, Storm-0842, Red Sandstorm, Banished Kitten, HOPPINGANT by researchers, Yorotrooper, Tomiris

Description

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.(Citation: Microsoft Targeting Elections September 2020)(Citation: Check Point APT31 February 2021)

Goals & Targeting

Targeted Sectors

Defense

Energy

Financial services

Healthcare

Technology

Aerospace & defense

Manufacturing

Government

Financial services

Transportation

Education

Critical infrastructure

Construction

Telecommunications

Media

Maritime

Aerospace

Retail

Aviation

Utilities

Chemical

Nuclear

Mining

Targeted Countries / Regions

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Command & Control

8 techniques

T1090

Proxy

T1090.003

Multi-hop Proxy

ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to proxy traffic.(Citation: ORB Mandiant)

T1102

Web Service

T1102.002

Bidirectional Communication

ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

T1105

Ingress Tool Transfer

ZIRCONIUM has used tools to download malicious files to compromised hosts.(Citation: Zscaler APT31 Covid-19 October 2020)

T1573

Encrypted Channel

T1573.001

Symmetric Cryptography

ZIRCONIUM has used AES encrypted communications in C2.(Citation: Zscaler APT31 Covid-19 October 2020)

T1665

Hide Infrastructure

Credential Access

2 techniques

T1555

Credentials from Password Stores

T1555.003

Credentials from Web Browsers

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.(Citation: Zscaler APT31 Covid-19 October 2020)

Discovery

5 techniques

T1012

Query Registry

ZIRCONIUM has used a tool to query the Registry for proxy settings.(Citation: Zscaler APT31 Covid-19 October 2020)

T1016

System Network Configuration Discovery

ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.(Citation: Zscaler APT31 Covid-19 October 2020)

T1033

System Owner/User Discovery

ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)

T1082

System Information Discovery

ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)

T1124

System Time Discovery

ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)

Execution

8 techniques

T1053.005

Scheduled Task

T1059

Command and Scripting Interpreter

T1059.003

Windows Command Shell

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.(Citation: Zscaler APT31 Covid-19 October 2020)

T1059.006

Python

ZIRCONIUM has used Python-based implants to interact with compromised hosts.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

T1106

Native API

T1204

User Execution

T1204.001

Malicious Link

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

T1204.002

Malicious File

Exfiltration

3 techniques

T1041

Exfiltration Over C2 Channel

ZIRCONIUM has exfiltrated files via the Dropbox API C2.(Citation: Zscaler APT31 Covid-19 October 2020)

T1567

Exfiltration Over Web Service

T1567.002

Exfiltration to Cloud Storage

ZIRCONIUM has exfiltrated stolen data to Dropbox.(Citation: Zscaler APT31 Covid-19 October 2020)

Initial Access

3 techniques

T1190

Exploit Public-Facing Application

T1566

Phishing

T1566.002

Spearphishing Link

ZIRCONIUM has used malicious links in e-mails to deliver malware.(Citation: Microsoft Targeting Elections September 2020)(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

Persistence

3 techniques

T1543.003

Windows Service

T1547

Boot or Logon Autostart Execution

T1547.001

Registry Run Keys / Startup Folder

ZIRCONIUM has created a Registry Run key named <code>Dropbox Update Setup</code> to establish persistence for a malicious Python binary.(Citation: Zscaler APT31 Covid-19 October 2020)

Privilege Escalation

1 technique

T1068

Exploitation for Privilege Escalation

ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.(Citation: Check Point APT31 February 2021)

Reconnaissance

2 techniques

T1598

Phishing for Information

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.(Citation: Google Election Threats October 2020)

T1598.003

Spearphishing Link

ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.(Citation: Microsoft Targeting Elections September 2020)

Resource Development

5 techniques

T1583

Acquire Infrastructure

T1583.001

Domains

ZIRCONIUM has purchased domains for use in targeted campaigns.(Citation: Microsoft Targeting Elections September 2020)

T1583.006

Web Services

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

T1584

Compromise Infrastructure

T1584.008

Network Devices

ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.(Citation: ORB APT31)(Citation: ORB Mandiant)

Stealth

10 techniques

T1027

Obfuscated Files or Information

T1027.002

Software Packing

ZIRCONIUM has used multi-stage packers for exploit code.(Citation: Check Point APT31 February 2021)

T1036

Masquerading

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)

T1036.004

Masquerade Task or Service

ZIRCONIUM has created a run key named <code>Dropbox Update Setup</code> to mask a persistence mechanism for a malicious binary.(Citation: Zscaler APT31 Covid-19 October 2020)

T1055.002

Portable Executable Injection

T1140

Deobfuscate/Decode Files or Information

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.(Citation: Check Point APT31 February 2021)

T1218

System Binary Proxy Execution

T1218.007

Msiexec

ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.(Citation: Zscaler APT31 Covid-19 October 2020)

T1497.001

System Checks