ZIRCONIUM

Origin🇨🇳 China

Techniques (MITRE ATT&CK)29

SourceMITRE ATT&CK

Also known as:APT31BRONZE VINEWOODJUDGMENT PANDARed keresTA412TIDE CASTLEViolet Typhoon

About the group

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity48

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 29

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Phishing for Information Spearphishing Link

Resource development

Domains Web Services Network Devices

Initial access

Spearphishing Link

Execution

Windows Command Shell Python Malicious Link

Persistence

Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation

Credential access

Credentials from Web Browsers

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery System Information Discovery System Time Discovery

Command and control

Multi-hop Proxy Bidirectional Communication Ingress Tool Transfer Symmetric Cryptography Hide Infrastructure

Exfiltration

Exfiltration Over C2 Channel Exfiltration to Cloud Storage

stealth

Software Packing Masquerading Masquerade Task or Service Deobfuscate/Decode Files or Information Msiexec

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-0005HIGHEPSS 11%KEV MITRE ATT&CK

References

ZIRCONIUM uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →