ZIRCONIUM

Zirconium, also known as APT31, Judgment Panda, and Red Keres, is a threat actor linked to numerous cyber espionage operations. The group came into the spotlight in 2022 when the Check Point Research team discovered that it had used a tool called "Jian," a clone of the NSA Equation Group's hacking tool "EpMe", years before it was leaked online by Shadow Brokers hackers. This revelation was surprising because the exploit, CVE-2017-0005, previously attributed to Zirconium, was in fact a reconstructed version of EpMe. Zirconium had access to EpMe’s files, both their 32-bits and 64-bits versions, more than two years before the Shadow Brokers leak. The group has been involved in various sophisticated campaigns, employing specific tactics, techniques, and procedures (TTPs), and using malware variants such as FourteenHi. Kaspersky's findings have linked APT31 with medium to high confidence to recent industrial attacks in Eastern Europe. In addition, researchers have noted similarities between these activities and previously researched campaigns, including ExCone and DexCone, further solidifying the attribution to Zirconium. Zirconium's methodology is elaborate, leveraging hybrid networks composed of multiple subnets and various payloads to recruit and organize popular routers like Cisco and ASUS. They have also developed malware for targeted data exfiltration from air-gapped environments. Despite the ongoing investigations and increased scrutiny, Zirconium continues to pose a significant threat to cybersecurity, underlining the need for robust defense mechanisms and continuous vigilance.