LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0128: ZIRCONIUM

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.[1][2]

EnterpriseG0128GroupObject v2.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

ATT&CK describes ZIRCONIUM, also known as APT31 and Violet Typhoon, as a China-based threat group active since at least 2017 and associated in reporting with targeting people connected to the 2020 U.S. presidential election and prominent international affairs leaders. For defenders, the useful takeaway is not the name alone: the mapped behaviors span phishing links, user-driven execution, discovery, credential access from browsers, persistence through Run Keys or startup folders, command-and-control over proxies/web services/encryption, tool transfer, and exfiltration over C2 or to cloud storage.

Executive priority

This group profile is most useful for prioritizing readiness around high-value people, politically or diplomatically sensitive work, and organizations where email, identity, endpoint, browser credentials, and cloud storage are business-critical. Leaders should ask whether the organization can prove prevention, detection, and response coverage for spearphishing links, suspicious script and command execution, browser credential theft, persistence changes, and unusual outbound or cloud-storage data movement.

Technical view

ATT&CK provides no group-specific detection text, so SOC and IR teams should validate coverage from the mapped techniques. Focus on Windows-relevant behaviors such as Registry queries, Run Key/startup persistence, cmd.exe, msiexec abuse, browser credential access, and task/service masquerading, while also checking cross-platform telemetry for Python execution, system/user/network discovery, inbound tool transfer, encrypted or proxied C2, and exfiltration to C2 or cloud storage. Detection logic should correlate early access indicators such as spearphishing links and malicious-link execution with follow-on discovery, persistence, credential access, and outbound transfer patterns.

Likely telemetry

  • Email security and URL-click telemetry for spearphishing links and malicious-link execution
  • Endpoint process creation, command-line, parent-child process, and script execution telemetry
  • Windows Registry auditing for discovery and Run Key/startup persistence changes
  • Service, scheduled task, startup folder, and task-name metadata for masquerading review
  • Browser credential store access and suspicious file access around browser profile data

Detection direction

  • Build behavior chains rather than relying on the group name: phishing link or user execution followed by discovery, credential access, persistence, tool transfer, and outbound transfer is higher-value than any single weak signal.
  • Tune Windows detections for cmd.exe, msiexec.exe, Registry queries, Run Key changes, and browser credential access, with allowlists for legitimate administration and software installation activity.
  • Review visibility gaps for encrypted C2, legitimate web-service communications, and cloud storage uploads, since these can blend into normal business traffic.
  • Use masquerading detections that compare task/service names, paths, publishers, and execution context against known-good baselines.
  • Treat proxy and cloud-service indicators carefully: the ATT&CK mapping supports these behaviors, but source IP attribution and service use alone are not reliable proof of this group.

Mitigation priorities

  • Prioritize phishing-resistant controls and user reporting workflows for high-risk staff and roles exposed to political, international affairs, or sensitive communications.
  • Harden endpoint execution paths by controlling script interpreters, command shell abuse, installer proxy execution, startup locations, and unauthorized persistence changes.
  • Reduce credential exposure by strengthening browser credential policy, endpoint protection, and identity monitoring for suspicious credential use.
  • Improve egress governance: monitor or restrict unsanctioned cloud storage, unusual external web-service use, and tool-transfer paths while preserving approved business workflows.
  • Maintain vulnerability and patch discipline because ATT&CK maps the group to exploitation for privilege escalation, but validate priorities against local asset exposure and exploitability.
Additional notes and limits

The decision value of this ATT&CK object comes from the relationship set: ZIRCONIUM is mapped to initial access through spearphishing links, execution through user action and command/script mechanisms, discovery, persistence, credential access, C2, and exfiltration. This supports a readiness review across SOC monitoring, incident response evidence collection, identity protection, cloud-storage governance, and vulnerability management.

ATT&CK provides no official detection guidance, no platforms on the intrusion-set object itself, and no claim here should be read as evidence of current activity against any specific organization. Platform references in this take come from related ATT&CK techniques, not from a group-level platform field. Local telemetry, exposure, and threat-intelligence validation are required before making risk or attribution judgments.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

ZIRCONIUM

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

29 rows
DomainIDNameRelationship / procedure
EnterpriseT1082System Information Discovery

ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.[3]

EnterpriseT1598Phishing for Information

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.[4]

EnterpriseT1012Query Registry

ZIRCONIUM has used a tool to query the Registry for proxy settings.[3]

EnterpriseT1665Hide Infrastructure

ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to obfuscate the origin of C2 traffic.[5]

EnterpriseT1059.003Windows Command ShellSub-technique

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.[3]

EnterpriseT1583.006Web ServicesSub-technique

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.[4][3]

EnterpriseT1584.008Network DevicesSub-technique

ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.[6][5]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.[3]

EnterpriseT1059.006PythonSub-technique

ZIRCONIUM has used Python-based implants to interact with compromised hosts.[4][3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.[3]

EnterpriseT1573.001Symmetric CryptographySub-technique

ZIRCONIUM has used AES encrypted communications in C2.[3]

EnterpriseT1124System Time Discovery

ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.[3]

EnterpriseT1140Deobfuscate/Decode Files or Information

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.[2]

EnterpriseT1598.003Spearphishing LinkSub-technique

ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

ZIRCONIUM has used malicious links in e-mails to deliver malware.[1][4][3]

EnterpriseT1583.001DomainsSub-technique

ZIRCONIUM has purchased domains for use in targeted campaigns.[1]

EnterpriseT1033System Owner/User Discovery

ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.[3]

EnterpriseT1090.003Multi-hop ProxySub-technique

ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to proxy traffic.[5]

EnterpriseT1041Exfiltration Over C2 Channel

ZIRCONIUM has exfiltrated files via the Dropbox API C2.[3]

EnterpriseT1036Masquerading

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.[4][3]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

ZIRCONIUM has exfiltrated stolen data to Dropbox.[3]

EnterpriseT1027.002Software PackingSub-technique

ZIRCONIUM has used multi-stage packers for exploit code.[2]

EnterpriseT1204.001Malicious LinkSub-technique

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.[4][3]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.[3]

EnterpriseT1068Exploitation for Privilege Escalation

ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.[2]

EnterpriseT1218.007MsiexecSub-technique

ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.[3]

EnterpriseT1105Ingress Tool Transfer

ZIRCONIUM has used tools to download malicious files to compromised hosts.[3]

EnterpriseT1016System Network Configuration Discovery

ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.[3]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.[4][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1598: Phishing for InformationEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1665: Hide InfrastructureEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1583.006: Web ServicesEnterpriseuses · TechniqueT1584.008: Network DevicesEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1059.006: PythonEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1598.003: Spearphishing LinkEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1583.001: DomainsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.3
Created
Modified
Raw hash
2d23caddc21c7275...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.3Current bundle2d23caddc21c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  2. [2]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  3. [3]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  4. [4]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  5. [5]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  6. [6]
    ORB APT31

    Cimpanu, Catalin. (2021, July 20). Chinese hacking group APT31 uses mesh of home routers to disguise attacks. Retrieved July 8, 2024.

    Open source URL
  7. [7]
    APT31

    (Citation: Check Point APT31 February 2021)

  8. [8]
    APT31

    (Citation: Check Point APT31 February 2021)

  9. [9]
    APT31

    (Citation: Check Point APT31 February 2021)

  10. [10]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  11. [11]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  12. [12]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  13. [13]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  14. [14]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  15. [15]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  16. [16]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  17. [17]
    Violet Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  18. [18]
    Violet Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  19. [19]
    Violet Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  20. [20]
    mitre-attackG0128
    Open source URL
  21. [21]
    mitre-attackG0128
    Open source URL
  22. [22]
    mitre-attackG0128
    Open source URL
  23. [23]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  24. [24]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  25. [25]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  26. [26]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  27. [27]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  28. [28]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  29. [29]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  30. [30]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  31. [31]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  32. [32]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  33. [33]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  34. [34]
    ORB APT31

    Cimpanu, Catalin. (2021, July 20). Chinese hacking group APT31 uses mesh of home routers to disguise attacks. Retrieved July 8, 2024.

    Open source URL
  35. [35]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  36. [36]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  37. [37]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  38. [38]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  39. [39]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  40. [40]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  41. [41]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  42. [42]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  43. [43]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  44. [44]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  45. [45]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  46. [46]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  47. [47]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  48. [48]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  49. [49]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  50. [50]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  51. [51]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  52. [52]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  53. [53]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  54. [54]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  55. [55]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  56. [56]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  57. [57]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  58. [58]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  59. [59]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  60. [60]
    Microsoft Targeting Elections September 2020

    Burt, T. (2020, September 10). New cyberattacks targeting U.S. elections. Retrieved March 24, 2021.

    Open source URL
  61. [61]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  62. [62]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  63. [63]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  64. [64]
    ORB Mandiant

    Raggi, Michael. (2024, May 22). IOC Extinction? China-Nexus Cyber Espionage Actors Use ORB Networks to Raise Cost on Defenders. Retrieved July 8, 2024.

    Open source URL
  65. [65]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  66. [66]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  67. [67]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  68. [68]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  69. [69]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  70. [70]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  71. [71]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  72. [72]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  73. [73]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  74. [74]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  75. [75]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  76. [76]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  77. [77]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  78. [78]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  79. [79]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  80. [80]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  81. [81]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  82. [82]
    Check Point APT31 February 2021

    Itkin, E. and Cohen, I. (2021, February 22). The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day. Retrieved March 24, 2021.

    Open source URL
  83. [83]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  84. [84]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  85. [85]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  86. [86]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
  87. [87]
    Google Election Threats October 2020

    Huntley, S. (2020, October 16). How We're Tackling Evolving Online Threats. Retrieved March 24, 2021.

    Open source URL
  88. [88]
    Zscaler APT31 Covid-19 October 2020

    Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use