Introduction
ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community. Microsoft Targeting Elections September 2020 Check Point APT31 February 2021
Activities and Tactics
Country of Origin: 🇨🇳 China
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1082 System Information Discovery
- T1598 Phishing for Information
- T1012 Query Registry
- T1665 Hide Infrastructure
- T1059.003 Windows Command Shell
- T1583.006 Web Services
- T1584.008 Network Devices
- T1555.003 Credentials from Web Browsers
- T1059.006 Python
- T1547.001 Registry Run Keys / Startup Folder
- T1573.001 Symmetric Cryptography
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1598.003 Spearphishing Link
- T1566.002 Spearphishing Link
- T1583.001 Domains
- T1033 System Owner/User Discovery
- T1090.003 Multi-hop Proxy
- T1041 Exfiltration Over C2 Channel
- T1036 Masquerading
- T1567.002 Exfiltration to Cloud Storage
- T1027.002 Software Packing
- T1204.001 Malicious Link
- T1036.004 Masquerade Task or Service
- T1068 Exploitation for Privilege Escalation
- T1218.007 Msiexec
- T1105 Ingress Tool Transfer
- T1016 System Network Configuration Discovery
- T1102.002 Bidirectional Communication
ATT&CK technique IDs (denormalized)
- T1012
- T1016
- T1027.002
- T1033
- T1036
- T1036.004
- T1041
- T1059.003
- T1059.006
- T1068
- T1082
- T1090.003
- T1102.002
- T1105
- T1124
- T1140
- T1204.001
- T1218.007
- T1547.001
- T1555.003
- T1566.002
- T1567.002
- T1573.001
- T1583.001
- T1583.006
- T1584.008
- T1598
- T1598.003
- T1665
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
Information pending cataloguing.
Attribution and Evidence
Country of Origin: China Additional attribution information pending cataloguing.
References
[1] mitre-attack [4] Microsoft Targeting Elections September 2020 Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021. [5] Check Point APT31 February 2021 Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021. [6] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.