Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · APT31 · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

APT31

  • ZIRCONIUM
  • JUDGMENT PANDA
  • BRONZE VINEWOOD
  • Red keres
  • Violet Typhoon
  • TA412
  • Zirconium
  • TIDE CASTLE

MITRE G0128 ↗

APT31 — ATT&CK roseAP

attack rose · 29 techniques across 11 tactics

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2017-0005, CVE-2025-49704, CVE-2025-49706
  2. —1 mo agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

29 techniques · 11 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    3 techniques

  3. Initial access

    1 technique

  4. Execution

    3 techniques

  5. Persistence

    1 technique

  6. Privilege escalation

    1 technique

  7. Stealth

    5 techniques

  8. Credential access

    1 technique

  9. Discovery

    5 techniques

  10. Command and control

    5 techniques

  11. Exfiltration

    2 techniques

select a technique

CVEs cited sources tie to APT31

2 on CISA KEV
  1. CVE-2025-49704KEV2026-10-17
    1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  2. CVE-2025-49706KEV2026-10-17
    1. “As early as July 7, 2025, Microsoft analysis suggests threat actors were attempting to exploit CVE-2025-49706 and CVE-2025-49704 to gain initial access to target organizations. These actors include Chinese state actors Linen Typhoon and Violet Typhoon and another China-based actor Storm-2603.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

  3. CVE-2017-00052026-10-17
    1. “The caught-in-the-wild exploit of CVE-2017-0005, a 0-Day attributed by Microsoft to the Chinese APT31 (Zirconium), is in fact a replica of an Equation Group exploit code-named “EpMe.””

      attributed by a report · source: research.checkpoint.com ↗ · 2026-10-17

    2. “ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    3. “Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit.”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

47 sources
  1. 1.microsoft.com/security/blog/2017/03/27/detecting-and-mitigating-elev…
  2. 2.duo.com/decipher/apt-groups-moving-down-the-supply-chain
  3. 3.go.recordedfuture.com/hubfs/reports/cta-2019-0206.pdf
  4. 4.redalert.nshc.net/2019/12/03/threat-actor-targeting-hong-kong-activists
  5. 5.twitter.com/bkMSFT/status/1201876664667582466
  6. 6.secureworks.com/research/bronz-vinewood-uses-hanaloader-to-target-gove…
  7. 7.secureworks.com/research/bronze-vinewood-targets-supply-chains
  8. 8.secureworks.com/research/threat-profiles/bronze-vinewood
  9. 9.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report
  10. 10.go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThrea…
  11. +37 more in the JSON record

Track APT31 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.