Threat Actor 🇨🇳 China
APT31
Also known as: ZIRCONIUM · JUDGMENT PANDA · BRONZE VINEWOOD · Red keres · Violet Typhoon · TA412 · Zirconium
FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting.
Indicators of Compromise 36
Filename Avpcheckup Filename C:\Users\Public\stomp_ext Filename ChromeUpdate.exe Filename Dataupcheckinfo Filename EdgeCore_AutoUpdate Filename GeForceService Filename MicrosoftEdgeUpdatesTaskMachine Filename cmd.exe Filename curl.exe Filename imjp14k.dll Filename msgbox.exe GitHub Repo wtyyvZQY/stU7BU0R MD5 12ec42446db8039e2a2d8c22d7fd2946 MD5 406db41215f7d333db2f2c9d60c3958b MD5 44a64331ec1c937a8385dfeeee6678fd MD5 751f47a688ae075bba11cf0235f4f6ee MD5 8dcf258f66fa0cec1e4a800fa1f6c2a2 MD5 d587724ade76218aa58c78523f6fa14e MD5 f806083c919e49aca3f301d082815b30 SHA-256 071e662fc5bc0e54bcfd49493467062570d0307dc46f0fb51a68239d281427c6 SHA-256 1f94ea00be79b1e4e8e0b7bbf2212f2373da1e13f92b4ca2e9e0ffc5f93e452b SHA-256 28a859046a43fc8a7a7453075130dd649eb2d1dd0ebf0abae5d575438a25ece9 SHA-256 568561d224ef29e5051233ab12d568242e95d911b08ce7f2c9bf2604255611a9 SHA-256 5b165b01f9a1395cae79e0f85b7a1c10dc089340cf4e7be48813ac2f8686ed61 SHA-256 6240e39475f04bfe55ab7cba8746bd08901d7678b1c7742334d56f2bc8620a35 SHA-256 6aecf805f72c9f35dadda98177f11ca6a36e8e7e4348d72eaf1a80a899aa6566 SHA-256 6c48a510642a1ba516dbc5effe3671524566b146e04d99ab7f4832f66b3f95aa SHA-256 7803ae7ba5d4e7d38e73745b3f321c2ca714f3141699d984322fa92e0ff037a1 SHA-256 7acf21677322ef2aa835b5836d3e4b8a6b78ae10aa29d6640885e933f83a4b01 SHA-256 7be8e37bc61005599e4e6817eb2a3a4a5519fded76cb8bf11d7296787c754d40 SHA-256 929e3fdd3068057632b52ecdfd575ab389390c852b2f4e65dc32f20c87521600 SHA-256 db15923c814a4b00ddb79f9c72f8546a44302ac2c66c7cc89a144cb2c2bb40fa SHA-256 dbdc1beeb5c72d7b505a9a6c31263fc900ea3330a59f08e574fd172f3596c1b8 SHA-256 e4ea34a7c2b51982a6c42c6367119f34bec9aeb9a60937836540035583a5b3bc SHA-256 e6c216cec379f418179a3f6a79df54dcf6e6e269a3ce3479fd7e6d4a15ac066e Registry User HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32
MITRE ATT&CK TTPs 28
T1003 T1003.001 T1018 T1021.001 T1027 T1053.005 T1055 T1055.001 T1059 T1059.001 T1059.003 T1068 T1071.001 T1071.003 T1078 T1082 T1083 T1087.002 T1105 T1133 T1190 T1203 T1204.002 T1210 T1218.001 T1558 T1566 T1573.001
OS Credential Dumping
Credential Access
LSASS Memory
Credential Access
Remote System Discovery
Discovery
Remote Desktop Protocol
Lateral Movement
Obfuscated Files or Information
Defense Evasion
Scheduled Task
Execution
Process Injection
Defense Evasion
Dynamic-link Library Injection
Defense Evasion
Command and Scripting Interpreter
Execution
PowerShell
Execution
Windows Command Shell
Execution
Exploitation for Privilege Escalation
Privilege Escalation
Web Protocols
Command And Control
Mail Protocols
Command And Control
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Domain Account
Discovery
Ingress Tool Transfer
Command And Control
External Remote Services
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation for Client Execution
Execution
Malicious File
Execution
Exploitation of Remote Services
Lateral Movement
Compiled HTML File
Defense Evasion
Steal or Forge Kerberos Tickets
Credential Access
Phishing
Initial Access
Symmetric Cryptography
Command And Control
Source Articles
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
A new exploit kit named 'BlueMoon' has been observed in the wild, leveraging chained zero-day vulnerabilities in Google Chrome and Microsoft Windows to achieve remote code execution and privilege escalation. The kit has been used by multiple cyber-espionage groups, including JungleBamboo (APT31) and UTA0560, in targeted attacks against NGOs, aerospace, defense, and manufacturing sectors. BlueMoon exploits three specific flaws: two in Chrome's V8 engine and one in Windows ALPC, enabling sandbox escape and local privilege escalation. The attacks are delivered via spearphishing, with payloads including malware loaders and in-memory backdoors such as Grimwedge and ShadowPad.
bleeping-computer ·1d ago
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Multiple espionage-motivated threat actors, including APT31 and several China-aligned clusters, have leveraged a previously undocumented exploit kit named BlueMoon to exploit unpatched vulnerabilities in Google Chrome and Microsoft Windows. The exploit chain combines CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to achieve sandbox escape and local privilege escalation, delivered via phishing emails leading to malicious URLs. The kit downloads payloads such as the GemStone browser backdoor, ShadowPad, and Rust-based malware using DLL sideloading and in-memory execution techniques. The U.S. CISA has added all three CVEs to its KEV catalog, mandating federal agencies to patch them by mid-September 2026.
hacker-news ·2d ago
Cyberespionage campaign PassiveNeuron targets machines running Windows Server | Securelist
The PassiveNeuron campaign is a sophisticated cyberespionage operation targeting government, financial, and industrial organizations in Asia, Africa, and Latin America. It primarily compromises Windows Server machines, often through SQL server exploitation, and deploys custom APT implants such as Neursite and NeuralExecutor. The attackers use a multi-stage DLL loader chain with anti-sandbox techniques and have shifted to using GitHub-based dead drop resolvers for C2 configuration in newer variants. Attribution remains challenging, but TTPs suggest a Chinese-speaking threat actor with low confidence.
Kaspersky-labs
ToolShell Used to Compromise Telecoms Company in Middle East | SECURITY.COM
China-based threat actors exploited the ToolShell vulnerability (CVE-2025-53770) to compromise a telecoms company in the Middle East and multiple government agencies globally shortly after the patch was released in July 2025. The attackers deployed backdoors such as Zingdoor and ShadowPad, used DLL sideloading techniques, and leveraged tools like KrustyLoader and Sliver for post-exploitation. Activities indicate espionage motives, with credential theft and lateral movement observed across compromised networks.
security.com