Skip to content

ZIRCONIUM

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

ATT&CK ID: G0128
Origin: China
Weather family: Typhoon
Techniques: 25
Tools: 0

Also tracked as APT31 · Violet Typhoon

Vulnerabilities it has exploited

CVE-2017-0005 Microsoft WindowsUnscored · exploited in the wild

Techniques

Reconnaissance

Phishing for Information

Resource Development

Acquire Infrastructure Compromise Infrastructure

Initial Access

Execution

Command and Scripting Interpreter User Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Exploitation for Privilege Escalation Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Deobfuscate/Decode Files or Information System Binary Proxy Execution

Credential Access

Credentials from Password Stores

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery System Information Discovery System Time Discovery

Command and Control

Proxy Web Service Ingress Tool Transfer Encrypted Channel Hide Infrastructure

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Web Service

MITRE ATT&CK All threat actors