APT31Threat actor
- bronze vinewood
- judgment panda
- red keres
- TA412
- tide castle
- Violet Typhoon
- zirconium
FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government.From MISP Galaxy
Last reported 3 days ago, by SecurityWeek7 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1684Social Engineering
“Passkey-themed campaign: Microsoft has spotted a pretty complex phishing and social engineering campaign hitting corporate environments using "fix your passkey" type of lures.”
- T1036Masquerading
“…SUPERSTOMP, which bypasses Chrome’s encrypted-hash integrity protections, to install LONGTALE, a credential-stealing Chrome extension masquerading as Google Gemini.”
- T1053.005Scheduled Task
“On execution, it establishes persistence by creating a scheduled task named “Windows Scheduled System” that re-runs the sideloading chain every five minutes:”
- T1055Process Injection
“URL of the binary to download after exploitation; passed to the browser-process injection stub’s command line; defaults to msgbox.exe relative to the page if not set”
- T1056.001Keylogging
“Keylogging and form capture”
- T1110Brute Force
“Recovered admin panels let operators run brute-force, web-exploit and DDoS campaigns and generate rotating proxy tunnels.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7“APT31 is China linked, Lazarus is North Korea, and Operation C-Major is Pakistan.”
-
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks“Last year, the Chinese state-sponsored groups Linen Typhoon and Violet Typhoon were seen exploiting two SharePoint vulnerabilities dubbed ToolShell as zero-days at least two weeks before public disclosure.”
-
Risky Bulletin: Anthropic agents went hacking again“They are TA412 (JungleBamboo, Violet Typhoon, APT31, TIDE CASTLE), UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket.”
-
Four groups caught using the same Chrome and Windows exploit kit“TA412, a China-aligned state-sponsored threat actor indicted by the US government in 2024 on behalf of China’s civilian foreign intelligence agency, repeatedly hit organizations focused on non-governmental organizations, mining companies, and physical commodity trading firms in t…”
-
Chinese espionage groups swarm to exploit triple-link chain of zero-days“The Chinese espionage group that Proofpoint tracks as TA412, also known as Violet Typhoon and APT31, struck first, exploiting the chain of vulnerabilities Aug.”
-
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows“Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post…”
-
Bulbature, beneath the waves of GobRAT“… that China uses edge devices as ORB to conduct offensive cyber campaigns, as previously reported in link with the Quad7 operator or the APT31 infrastructure.”
Indicators in its reports
named in the reports above- collusion[.]wikiin 1 report
- hxxps://cloud.shinewrist[.]net/in 1 report
- cloud.shinewrist[.]netin 1 report
- hxxp://cloud.shinewrist[.]net/in 1 report
- hxxps://ocr.opusaccel[.]topin 1 report
- ocr.opusaccel[.]topin 1 report
- hxxps://photos.msbenefit[.]com/fb/w3zin 1 report
- photos.msbenefit[.]comin 1 report
- hxxps://proof.gitprogram[.]com/a4/j8in 1 report
- proof.gitprogram[.]comin 1 report
- hxxps://xyz0102.gitprogram[.]com/a001in 1 report
- xyz0102.gitprogram[.]comin 1 report
- document.gitprogram[.]comin 1 report
- d71bedcf-307a-4432-beec-ce943223d0e3.cfargotunnel[.]comin 1 report
- 206.166.251[.]164in 1 report
- gitprogram[.]comin 1 report
- msbenefit[.]comin 1 report
- d17053557bb90298…b1f51a82343bin 1 report
- 337b48c1cd6dd6e7…41fffa3b130din 1 report
- 7a52ff23949edee8…90762ea3985cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.