ZIRCONIUM

Names and who uses them

• ZIRCONIUMOur name
• APT31Check Point
• Violet TyphoonMicrosoft

Targets

Regions: United States

Known techniques

• T1012Query Registry
• T1016System Network Configuration Discovery
• T1027.002Software Packing
• T1033System Owner/User Discovery
• T1036Masquerading
• T1036.004Masquerade Task or Service
• T1041Exfiltration Over C2 Channel
• T1059.003Windows Command Shell
• T1059.006Python
• T1068Exploitation for Privilege Escalation
• T1082System Information Discovery
• T1090.003Multi-hop Proxy
• T1102.002Bidirectional Communication
• T1105Ingress Tool Transfer
• T1124System Time Discovery
• T1140Deobfuscate/Decode Files or Information
• T1204.001Malicious Link
• T1218.007Msiexec
• T1547.001Registry Run Keys / Startup Folder
• T1555.003Credentials from Web Browsers
• T1566.002Spearphishing Link
• T1567.002Exfiltration to Cloud Storage
• T1573.001Symmetric Cryptography
• T1583.001Domains
• T1583.006Web Services
• T1584.008Network Devices
• T1598Phishing for Information
• T1598.003Spearphishing Link
• T1665Hide Infrastructure