FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also according to Crowdstrike, this adversary is suspected of continuing to target upstream providers (e.g., law firms and managed service providers) to support additional intrusions against high-profile assets. In 2018, CrowdStrike observed this adversary using spear-phishing, URL “web bugs” and scheduled tasks to automate credential harvesting.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | ZIRCONIUM |
| OSINT | JUDGMENT PANDA |
| OSINT | BRONZE VINEWOOD |
| OSINT | Red keres |
| OSINT | Violet Typhoon |
| OSINT | TA412 |
| OSINT | TIDE CASTLE |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names APT31, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT31. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.