- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- State-sponsored, Ministry of State Security
- Motivation
- Information theft and espionage
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G0128 · 29 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0163 · zirconium
ChinaWhat it is
ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Judgment Panda
- Mandiant
- APT 31, APT31
- Microsoft
- Violet Typhoon
- MITRE ATT&CK
- G0128
- Proofpoint
- TA412
- PwC
- Red Keres
- Other names
- APT 31, Judgment Panda, Zirconium, Bronze Vinewood, Chameleon, RedBravo, TIDE CASTLE, WebFans
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Belarus, Canada, Czech, Finland, France, Mongolia, Norway, Russia, United Kingdom, United States
Tools
The tools and malware families the sources tie to it.
- StreamEx
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de