Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines.(Citation: CrowdStrike Grim Spider May 2019) It has also used PowerShell to execute commands and move laterally through a victim network.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: Red Canary Hospital Thwarted Ryuk October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

Wizard Spider has used scheduled tasks establish persistence for

TrickBot and other malware.(Citation: CrowdStrike Grim Spider May 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Wizard Spider has used scheduled tasks to install

TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.(Citation: CrowdStrike Grim Spider May 2019) It has also used common document file names for other malware binaries.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either

Emotet, Bokbot,

TrickBot, or

Bazar.(Citation: CrowdStrike Grim Spider May 2019)(Citation: CrowdStrike Wizard Spider October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1112|Modify Registry|

Wizard Spider has modified the Registry key

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either

Emotet, Bokbot,

TrickBot, or


Wizard Spider has modified the Registry key

Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either

Emotet, Bokbot,

TrickBot, or

Bazar.(Citation: CrowdStrike Grim Spider May 2019)(Citation: Red Canary Hospital Thwarted Ryuk October 2020)|


ZIRCONIUM - G0128

Created: 2021-03-24T15:48:17.731Z

Modified: 2023-03-22T22:10:43.732Z

Contributors:

Aliases

ZIRCONIUM,APT31

Description

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.(Citation: Microsoft Targeting Elections September 2020)(Citation: Check Point APT31 February 2021)

Techniques Used

ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.(Citation: Microsoft Targeting Elections September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

ZIRCONIUM has exfiltrated stolen data to Dropbox.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

ZIRCONIUM has created a run key named

ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.(Citation: Check Point APT31 February 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.(Citation: Check Point APT31 February 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|


ZIRCONIUM has used multi-stage packers for exploit code.(Citation: Check Point APT31 February 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

ZIRCONIUM has used tools to download malicious files to compromised hosts.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

ZIRCONIUM has exfiltrated files via the Dropbox API C2.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

ZIRCONIUM has used AES encrypted communications in C2.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|


ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

ZIRCONIUM has used a tool to query the Registry for proxy settings.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

ZIRCONIUM has created a Registry Run key named

ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|


ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|PRE|T1598|Phishing for Information|

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.(Citation: Google Election Threats October 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

ZIRCONIUM has used Python-based implants to interact with compromised hosts.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

ZIRCONIUM has used malicious links in e-mails to deliver malware.(Citation: Microsoft Targeting Elections September 2020)(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

ZIRCONIUM has purchased domains for use in targeted campaigns.(Citation: Microsoft Targeting Elections September 2020)|