APT31

APT31, also known as Zirconium, is a threat actor believed to be linked to the Chinese government. This group has been associated with numerous cyber attacks, including a significant exploit of CVE-2017-0005. This exploit, dubbed "Jian," was initially attributed to APT31 but upon further analysis by Lockheed Martin's Computer Incident Response Team and other cybersecurity entities, it was discovered that Jian was actually a reconstructed version of an Equation Group exploit called "EpMe". The revelation indicated that APT31 likely copied the exploit from the Equation Group rather than developing it independently. In addition to the CVE-2017-0005 exploit, APT31 has been implicated in several large-scale cyber campaigns. Kaspersky identified an EastWind campaign targeting Russian organizations using CloudSorcerer and tools from both APT31 and APT27. Furthermore, APT31 was linked to attacks on the Inter-Parliamentary Alliance on China, a pressure group dedicated to countering Beijing. The group uses a variety of tactics, including malware delivery via phishing emails for initial access. One such malware, dubbed "GrewApacha," has been used by APT31 since at least 2021. Working with other cybersecurity vendors, governments, and law enforcement agencies, Sophos spearheaded a counter-offensive effort named "Pacific Rim" to combat these cyber threats. In this initiative, they found overlapping sets of tactics, tools, and procedures among different Chinese hacking groups, including Volt Typhoon, APT31, and APT41, who managed to penetrate Sophos firewalls starting in early 2020. These findings highlight the sophisticated and persistent nature of APT31 and related threat actors.