ZIRCONIUM

Threat Actor

1 incident First seen 2026-10-21 Last seen 2026-10-21

Overview

                            
                             Highlight CTI
                        

ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.

Investigate in CTI Graph Login required Open in Dashboard

Threat ecosystem

Actors Malware Campaigns CVEs

Tap a node for a quick look · double-tap to open its profile

At a glance

peak priority 180 30 techniques in ATT&CK since 2021-03-24 updated 2026-07-31 · v2.3

Activity by month (incidents)

2026-102026-10

Sectors targeted

energy · 1finance · 1government · 1health · 1manufacturing · 1technology · 1

Countries targeted

AO · 1AR · 1AT · 1AU · 1BE · 1BF · 1BG · 1BI · 1BJ · 1BO · 1BR · 1BW · 1

Origin

AT · 1BE · 1BG · 1CN · 1CY · 1CZ · 1

Kinds of incident

Critical Infrastructure & OT · 1Cyberattack (general) · 1Data Breach · 1Exploited Vulnerability · 1Ransomware & Extortion · 1

Techniques seen in incidents

Data Breach · 1Data Leak · 1Espionage · 1Exfiltration · 1Extortion · 1Lateral Movement · 1Phishing · 1Ransomware · 1T1021.001 - Remote Desktop Protocol · 1T1021.006 - Windows Remote Management · 1

Related malware

Qilin · 1

Related CVEs

CVE-2020-3259 · 1CVE-2023-20269 · 1

ATT&CK techniques by tactic (30)

reconnaissance T1598 Phishing for Information T1598.003 Spearphishing Link

resource development T1583.001 Domains T1583.006 Web Services T1584.008 Network Devices

initial access T1566.002 Spearphishing Link

execution T1059.003 Windows Command Shell T1059.006 Python T1204.001 Malicious Link

persistence T1547.001 Registry Run Keys / Startup Folder

privilege escalation T1068 Exploitation for Privilege Escalation T1547.001 Registry Run Keys / Startup Folder

credential access T1555.003 Credentials from Web Browsers

discovery T1012 Query Registry T1016 System Network Configuration Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1124 System Time Discovery

command and control T1090.003 Multi-hop Proxy T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1573.001 Symmetric Cryptography T1665 Hide Infrastructure

exfiltration T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration to Cloud Storage

stealth T1027.002 Software Packing T1036 Masquerading T1036.004 Masquerade Task or Service T1140 Deobfuscate/Decode Files or Information T1218.007 Msiexec

Incident timeline

2026-10-21

Rapid7 Identifies High-Severity Flaws Exploited in Three Days via Internet.

Data Breaches Infosecurity-Magazine Dailysecu SecurityWeek Infosecurity-Magazine Infosecurity-Magazine Cybersecurity Dive DB Digest Chosun Economy