ZIRCONIUM
- ID
- G0128
- Associated names
- APT31, Violet Typhoon
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.[1][2]
Techniques used (29)
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1027.002 Software Packing
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.004 Masquerade Task or Service
- T1041 Exfiltration Over C2 Channel
- T1059.003 Windows Command Shell
- T1059.006 Python
- T1068 Exploitation for Privilege Escalation
- T1082 System Information Discovery
- T1090.003 Multi-hop Proxy
- T1102.002 Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1124 System Time Discovery
- T1140 Deobfuscate/Decode Files or Information
- T1204.001 Malicious Link
- T1218.007 Msiexec
- T1547.001 Registry Run Keys / Startup Folder
- T1555.003 Credentials from Web Browsers
- T1566.002 Spearphishing Link
- T1567.002 Exfiltration to Cloud Storage
- T1573.001 Symmetric Cryptography
- T1583.001 Domains
- T1583.006 Web Services
- T1584.008 Network Devices
- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1665 Hide Infrastructure