ZIRCONIUM
Associated Group Descriptions
| Name | Description |
|---|---|
| APT31 |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1583 | .001 | Acquire Infrastructure: Domains |
ZIRCONIUM has purchased domains for use in targeted campaigns.[1] |
| .006 | Acquire Infrastructure: Web Services |
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.[3][4] |
||
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
ZIRCONIUM has created a Registry Run key named |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.[4] |
| .006 | Command and Scripting Interpreter: Python |
ZIRCONIUM has used Python-based implants to interact with compromised hosts.[3][4] |
||
| Enterprise | T1555 | .003 | Credentials from Password Stores: Credentials from Web Browsers |
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.[4] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information |
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.[2] |
|
| Enterprise | T1573 | .001 | Encrypted Channel: Symmetric Cryptography | |
| Enterprise | T1041 | Exfiltration Over C2 Channel | ||
| Enterprise | T1567 | .002 | Exfiltration Over Web Service: Exfiltration to Cloud Storage | |
| Enterprise | T1068 | Exploitation for Privilege Escalation |
ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.[2] |
|
| Enterprise | T1105 | Ingress Tool Transfer |
ZIRCONIUM has used tools to download malicious files to compromised hosts.[4] |
|
| Enterprise | T1036 | Masquerading |
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.[3][4] |
|
| .004 | Masquerade Task or Service |
ZIRCONIUM has created a run key named |
||
| Enterprise | T1027 | .002 | Obfuscated Files or Information: Software Packing | |
| Enterprise | T1566 | .002 | Phishing: Spearphishing Link |
ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.[1][3][4] |
| Enterprise | T1598 | Phishing for Information |
ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.[3] |
|
| Enterprise | T1012 | Query Registry |
ZIRCONIUM has used a tool to query the Registry for proxy settings.[4] |
|
| Enterprise | T1218 | .007 | Signed Binary Proxy Execution: Msiexec |
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.[4] |
| Enterprise | T1082 | System Information Discovery |
ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.[4] |
|
| Enterprise | T1016 | System Network Configuration Discovery |
ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.[4] |
|
| Enterprise | T1033 | System Owner/User Discovery |
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.[4] |
|
| Enterprise | T1124 | System Time Discovery |
ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.[4] |
|
| Enterprise | T1204 | .001 | User Execution: Malicious Link |
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.[3][4] |
| Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.[3][4] |