ZIRCONIUM
Associated Group Descriptions |
|
| Name | Description |
|---|---|
| APT31 | (Citation: Check Point APT31 February 2021) |
| Violet Typhoon | (Citation: Microsoft Threat Actor Naming July 2023) |
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1583 | .001 | Acquire Infrastructure: Domains |
ZIRCONIUM has purchased domains for use in targeted campaigns.(Citation: Microsoft Targeting Elections September 2020) |
| .006 | Acquire Infrastructure: Web Services |
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020) |
||
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
ZIRCONIUM has created a Registry Run key named |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.(Citation: Zscaler APT31 Covid-19 October 2020) |
| .006 | Command and Scripting Interpreter: Python |
ZIRCONIUM has used Python-based implants to interact with compromised hosts.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020) |
||
| Enterprise | T1584 | .008 | Compromise Infrastructure: Network Devices |
ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.(Citation: ORB APT31)(Citation: ORB Mandiant) |
| Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography |
ZIRCONIUM has used AES encrypted communications in C2.(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage |
ZIRCONIUM has exfiltrated stolen data to Dropbox.(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1036 | .004 | Masquerading: Masquerade Task or Service |
ZIRCONIUM has created a run key named |
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing |
ZIRCONIUM has used multi-stage packers for exploit code.(Citation: Check Point APT31 February 2021) |
| Enterprise | T1566 | .002 | Phishing: Spearphishing Link |
ZIRCONIUM has used malicious links in e-mails to deliver malware.(Citation: Microsoft Targeting Elections September 2020)(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1598 | .003 | Phishing for Information: Spearphishing Link |
ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.(Citation: Microsoft Targeting Elections September 2020) |
| Enterprise | T1090 | .003 | Proxy: Multi-hop Proxy |
ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to proxy traffic.(Citation: ORB Mandiant) |
| Enterprise | T1218 | .007 | System Binary Proxy Execution: Msiexec |
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1204 | .001 | User Execution: Malicious Link |
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020) |
| Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020) |
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.