Home / Threat actors / ZIRCONIUM
ZIRCONIUM G0128
Also known as: APT31, Violet Typhoon
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
30
Techniques
0
Malware and tools
ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2017-0005
High · 7.8
KEV Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability
“ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.”
Techniques by tactic
Reconnaissance
T1598 Phishing for InformationT1598.003 Spearphishing Link Resource Development
T1583.001 DomainsT1583.006 Web ServicesT1584.008 Network Devices Initial Access
T1566.002 Spearphishing Link Execution
T1059.003 Windows Command ShellT1059.006 PythonT1204.001 Malicious Link Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1068 Exploitation for Privilege EscalationT1547.001 Registry Run Keys / Startup Folder Stealth
T1027.002 Software PackingT1036 MasqueradingT1036.004 Masquerade Task or ServiceT1140 Deobfuscate/Decode Files or InformationT1218.007 Msiexec Credential Access
T1555.003 Credentials from Web Browsers Discovery
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1082 System Information DiscoveryT1124 System Time Discovery Command and Control
T1090.003 Multi-hop ProxyT1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1573.001 Symmetric CryptographyT1665 Hide Infrastructure Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration to Cloud Storage © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.