APT31

Also known as ZIRCONIUM, JUDGMENT PANDA, BRONZE VINEWOOD, Red keres, Violet Typhoon, TA412, TIDE CASTLE

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1012 Query Registry T1016 System Network Configuration Discovery T1027.002 Software Packing T1033 System Owner/User Discovery T1036 Masquerading T1036.004 Masquerade Task or Service T1041 Exfiltration Over C2 Channel T1059.003 Windows Command Shell T1059.006 Python T1068 Exploitation for Privilege Escalation T1082 System Information Discovery T1090.003 Multi-hop Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1124 System Time Discovery T1140 Deobfuscate/Decode Files or Information T1204.001 Malicious Link T1218.007 Msiexec T1547.001 Registry Run Keys / Startup Folder T1555.003 Credentials from Web Browsers T1566.002 Spearphishing Link T1567.002 Exfiltration to Cloud Storage T1573.001 Symmetric Cryptography T1583.001 Domains T1583.006 Web Services T1584.008 Network Devices T1598 Phishing for Information T1598.003 Spearphishing Link T1665 Hide Infrastructure

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.