ZIRCONIUM

Overview

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

Naming & attribution

ZIRCONIUM is tracked under 3 names across the industry. It uses 29 documented ATT&CK techniques — more than 64% of the 174 groups tracked here. Activity attributed since at least 2017.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1665 Hide Infrastructure — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Winter Vivern Russia — 10 shared techniques (22% overlap)
• MuddyWater Iran — 17 shared techniques (21% overlap)
• LazyScripter — 8 shared techniques (20% overlap)
• Higaisa South Korea — 9 shared techniques (19% overlap)
• APT32 Vietnam — 16 shared techniques (18% overlap)
• Turla Russia — 15 shared techniques (18% overlap)

TTPs — 29 techniques across 11 tactics

Reporting (3)

• How Microsoft names threat actors — Microsoft
• The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day — Itkin, E. and Cohen, I
• New cyberattacks targeting U.S. elections — Burt, T