APT
ATLAS
Atlas
Actors
145
Names
507
Sectors
40
⌘K
▸
sign in
Atlas
Actors
145
Names
507
Sectors
40
LOADING
APT31 (aka Zirconium, Red keres) · APT Atlas
Actors
/
Nation-state / APT
/
Asia
APT31
G0128
APT
CN · China
AKA
Zirconium · Red keres
Microsoft
:
Violet Typhoon
CrowdStrike
:
JUDGMENT PANDA
Secureworks
:
BRONZE VINEWOOD
MITRE
:
G0128
Proofpoint
:
TA412
Targets
6
Sectors
10
Threat types
1
GIRs mapped
0/480
Active since
2013
Explore in atlas
Save actor
Share
Export
STIX 2.1
ATT&CK Navigator
Also tracked as
6 vendor names · 2 other aliases
Open Rosetta Stone
CrowdStrike
JUDGMENT PANDA
Mandiant
APT31
Microsoft
Violet Typhoon
MITRE
G0128
Proofpoint
TA412
Secureworks
BRONZE VINEWOOD
UNATTRIBUTED ALIASES
Zirconium
Red keres
Victimology
Geographic footprint · 6 countries
Export STIX
origin · China
targeted countries · 6
AMERICAS ·
3
Brazil
·
Canada
·
United States
ASIA ·
2
Myanmar
·
Mongolia
EUROPE ·
1
Sweden
Sectors targeted
10 of 40
Government
100 actors
Defense
72 actors
Financial Services
73 actors
Technology
60 actors
Telecom
71 actors
Energy / Utilities
58 actors
Oil and Gas
21 actors
Education & Research
62 actors
Manufacturing (man)
49 actors
Legal & Professional
17 actors
Tactics, techniques, procedures
Threat types + MITRE ATT&CK mapping
THREAT TYPES
ESP · Espionage
MITRE ATT&CK · 24 techniques
Reconnaissance
· 1
T1598
Phishing for Information
Resource Development
· 1
T1583.006
Web Services
Initial Access
· 1
Execution
· 3
T1059.003
Windows Command Shell
T1059.006
Python
Persistence
· 1
Privilege Escalation
· 1
T1068
Exploitation for Privilege Escalation
Credential Access
· 1
T1555.003
Credentials from Web Browsers
Discovery
· 4
T1012
Query Registry
T1016
System Network Configuration Discovery
Exfiltration
· 2
T1041
Exfiltration Over C2 Channel
T1567.002
Exfiltration to Cloud Storage
Command And Control
· 4
T1090.003
Multi-hop Proxy
Stealth
· 5
T1027.002
Software Packing
T1036
Masquerading
T1036.004
Masquerade Task or Service
GIR mappings
0 / 480 requirements mapped
Open matrix
No GIRs mapped yet for this actor.
References
No supporting references have been recorded for this profile. Treat uncited claims as unverified.
Open data
Machine-readable exports of this profile
JSON · REST
Actor record
Full profile via the public v1 API
STIX 2.1
Intrusion-set bundle
Deterministic ids · techniques + targeted countries
ATT&CK NAVIGATOR
Technique layer
24 techniques · layer format 4.5
Related actors
By origin and actor type
Agrius
nation-state
Iran · 2 targets · since 2020
AppleJeus
nation-state
North Korea · 25 targets · since 2018
APT1
nation-state
China · 17 targets · since 2006
APT10
nation-state
China · 19 targets · since 2009
APT12
nation-state
China · 11 targets · since 2009
APT14
nation-state
China · 15 targets · since —
T1566.002
Spearphishing Link
T1204.001
Malicious Link
T1547.001
Registry Run Keys / Startup Folder
T1033
System Owner/User Discovery
T1124
System Time Discovery
T1102.002
Bidirectional Communication
T1105
Ingress Tool Transfer
T1665
Hide Infrastructure
T1140
Deobfuscate/Decode Files or Information
T1218.007
Msiexec