ZIRCONIUM

MITRE ATT&CK: G0128 View on attack.mitre.org

Aliases: APT31, Violet Typhoon, ZIRCONIUM, JUDGMENT PANDA, BRONZE VINEWOOD, Red keres, TA412, Zirconium, Chameleon, WebFans

First seen
2017-01-01 00:00:00
Origin
CN
Primary motivation
espionage
Sophistication
expert
Resource level
government
Actor type
nation-state
Related IoCs
18 (17 malicious)
Last IoC activity
2026-07-30 14:46:07
Profile updated
2026-07-07 12:34:47

Targeted industries: government-and-public-sector technology-and-telecommunications media-and-entertainment

Targeted regions: country_code:us country_code:cn

Context

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

Recent IoC activity

17 malicious indicators in Maltiverse are attributed to ZIRCONIUM (G0128). The 17 most recently updated:

TypeIndicatorUpdatedSources
file sample tmp7oi279y6 2026-07-30 2
file sample bounty-68090320269009011 2026-07-17 2
file sample fefa00b0d9a411029f51f34bfa4ed2327559edfcd4fad5cfc1234c1c01a97c5a 2026-03-03 1
file sample f332a941d786148a35cec683edb965ea4bbd6ff6bd871880f30dc7d42b922443 2026-03-03 1
file sample fade96ec359474962f2167744ca8c55ab4e6d0700faa142b3d95ec3f4765023b 2026-03-03 1
file sample e98d8ae395ec7d2bbc29c21fa2bf79e26ada9d8bd5098487027b32aeae8b03b7 2026-03-03 1
file sample e89079508dca536019535bb021ae388a990d9cb64e1e6bd769e6a29ec237d8be 2026-03-03 1
file sample c444a2b741273b5bb86c5197d931cbd3b121043e6e6cb5604b02719415d92b08 2026-03-03 1
file sample c3056e39f894ff73bba528faac04a1fc86deeec57641ad882000d7d40e5874be 2026-03-03 1
file sample 7fda8879c55398434ab0f423b0f1c75658bddd925d90437ad2e6fd8723cb1d78 2026-03-03 1
file sample 78a20e644f593acb71d94be96ed1e3a9ba7515be2c50aef844277a9e5c03637a 2026-03-03 1
file sample 76124bdee942090ec4b5f2a7e08ffe6dae758bc747d6565f6c5941ab81d79044 2026-03-03 1
file sample 6f9512a5f2f86938075b14e34928d07cdc78f46ed9401dea799f131f7a3d9644 2026-03-03 1
file sample 6a9979638d4e4719cfef65bdd6e1d7c0b28b84df9ca73a3bc1e919e9a1df50df 2026-03-03 1
file sample 697db25145c2d37f0a521b3ca6b49f1f4d7c3e0c2e57804f5317b3d0b6d242fb 2026-03-03 1
file sample 52238d884006a06e363e546dcfa88c1b2cbdadd80c717e415ac26956900f40bf 2026-03-03 1
hostname www.jxedunavi.com 2025-10-21 1

Detection coverage

  • 326 Sigma rules

Malware & tools used

  • System Information Discovery (attack-pattern)
  • Phishing for Information (attack-pattern)
  • Query Registry (attack-pattern)
  • Hide Infrastructure (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Web Services (attack-pattern)
  • Network Devices (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Python (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • System Time Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Domains (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Multi-hop Proxy (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Masquerading (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • Software Packing (attack-pattern)
  • Malicious Link (attack-pattern)
  • Masquerade Task or Service (attack-pattern)
  • Exploitation for Privilege Escalation (attack-pattern)

Exploited vulnerabilities

  • CVE-2017-0005 (vulnerability)

Reports & references

  • Mandiant — Apt Groups (report)
  • cloud.google.com — Updated Cyber Threat Actor Naming System (report)
  • pwc.com — Yir Cyber Threats Report Download (report)
  • pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
  • Microsoft — Rwmfii (report)
  • CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
  • proofpoint.com — Above Fold And Your Inbox Tracing State Aligned Activity Targeting Journalists (report)
  • CrowdStrike — 2019 Crowdstrike Global Threat Report (report)
  • ncsc.gov.uk — Uk Allies Hold Chinese State Responsible For Pervasive Pattern Of Hacking (report)
  • gov.uk — Uk And Allies Hold Chinese State Responsible For A Pervasive Pattern Of Hacking (report)
  • foreignminister.gov.au — Australia Joins International Partners Attribution Malicious Cyber Activity China (report)
  • consilium.europa.eu — Declaration By The High Representative On Behalf Of The Eu Urging China To Take Action Against Malicious Cyber Activities Undertaken From Its Territory (report)
  • Microsoft — Detecting And Mitigating Elevation Of Privilege Exploit For Cve 2017 0005 (report)
  • duo.com — Apt Groups Moving Down The Supply Chain (report)
  • go.recordedfuture.com — Cta 2019 0206 (report)
  • redalert.nshc.net — Threat Actor Targeting Hong Kong Activists (report)
  • twitter.com — 1201876664667582466 (report)
  • secureworks.com — Bronz Vinewood Uses Hanaloader To Target Government Supply Chain (report)
  • secureworks.com — Bronze Vinewood Targets Supply Chains (report)
  • secureworks.com — Bronze Vinewood (report)
  • research.checkpoint.com — The Story Of Jian (report)
  • supo.fi — Suojelupoliisi Tunnisti Eduskuntaan Kohdistuneen Kybervakoiluoperaation Apt31 Ksi (report)
  • poliisi.fi — Eduskunnan Tietojarjestelmiin Kohdistuneen Tietomurron Tutkinnassa Selvitetaan Yhteytta Apt31 Toimijaan (report)
  • pst.no — Etterforskningen Av Datanettverksoperasjonen Mot Fylkesmannsembetene Er Avsluttet (report)
  • nrk.no — Pst Har Etterretning Om At Kinesisk Gruppe Stod Bak Dataangrep Mot Statsforvaltere 1.15540601 (report)

Attributed from

  • FLORAHOX Activity (campaign)

External references