ChinaAttributedMSS Hubei State Security DeptEspionageActive 2010 – 2026Zirconium
Also known asJudgment Panda · Bronze Vinewood · TA412 · RedBravo · Violet Typhoon · Red Keres
Summary
MSS-attributed group targeting political figures and election campaigns globally. US/UK/EU/Australia sanctioned APT31 March 2024 — DoJ indicted seven Wuhan XRZ hackers, the largest Chinese cyber indictment.
Attribution
AttributedGovernment attribution: MSS Hubei State Security Dept
Named by a government: indictment, sanctions designation, joint advisory or official statement.
Sources
- US Department of Justice (Government, 2024-03-25)
Indictment: APT31 is a program run by the MSS's Hubei State Security Department - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Operates out of China
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| BlueMoon exploit kit (Chrome V8 + Windows kernel zero-days) against US NGOs, mining and commodity-trading firms | 2026-08 – 2026-09 | USA | NGO, Mining, Commodity Trading | Proofpoint (2026-09-09) — TA412, first adopter of BlueMoon |
| SharePoint on-prem exploitation (ToolShell wave) | 2025-07 | Global (internet-facing SharePoint servers) | Government, NGO, Think Tanks, Higher Education, Media | Microsoft Threat Intelligence (2025-07-22) |
| Czech Ministry of Foreign Affairs unclassified network intrusion | 2022 – 2025-05 | Czech Republic | Government, Diplomatic | NÚKIB / Czech Government national attribution (2025-05-28) |
| Russian IT contractors & government integrators — cloud-C2 intrusions | 2022 – 2025 | Russia | IT services, Government contractors | Positive Technologies ESC 'Striking Panda' (2025-11), via The Hacker News |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Initial Access2 | T1566.002Spearphishing LinkT1190Exploit Public-Facing Application |
|---|---|
| Execution2 | T1059.001PowerShellT1053.005Scheduled Task |
| Persistence1 | T1078Valid Accounts |
| Stealth2 | T1055Process InjectionT1574.001DLL |
| Exfiltration1 | T1567.002Exfiltration to Cloud Storage |
| Command and Control2 | T1102.001Dead Drop ResolverT1665Hide Infrastructure |
Malware and tools 12
| Name | Description | Platform |
|---|---|---|
| RAWDOOR | Backdoor | Windows |
| PlugX | Modular RAT | Windows |
| Cobalt Strike | Post-exploitation | Windows/Linux |
| CloudyLoader | Loader (Cobalt Strike, DLL side-loaded) | Windows |
| CloudSorcerer | Backdoor (cloud-service C2) | Windows |
| OneDriveDoor | Backdoor (OneDrive C2) | Windows |
| COFFProxy | Backdoor / tunneller (Go) | Windows |
| VtChatter | C2 tool (VirusTotal comments) | Windows |
| AufTime | Backdoor | Linux |
| YaLeak | Exfiltration tool (.NET, Yandex Cloud) | Windows |
| Owawa | Malicious IIS module (credential theft) | Windows |
| GemStone | Malicious Chromium browser extension (installed after BlueMoon exploitation) | Windows |
Exploited vulnerabilities 6
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2025-49704 | 8.8 | Microsoft SharePoint (on-prem) — code injection RCE (KEV 2025-07-22) |
| CVE-2026-85046 | 8.8 | Chromium V8 — type confusion RCE, 0-day (KEV 2026-09-04) |
| CVE-2026-87491 | 8.8 | Chromium V8 — out-of-bounds write (V8 sandbox escape), 0-day (KEV 2026-09-09) |
| CVE-2017-0005 | 7.8 | Windows GDI — privilege escalation (KEV 2022-05-24) |
| CVE-2026-85880 | 7.8 | Microsoft Windows ALPC — heap-based buffer overflow LPE, 0-day (KEV 2026-09-08) |
| CVE-2025-49706 | 6.5 | Microsoft SharePoint (on-prem) — spoofing / improper authentication (KEV 2025-07-22) |
Highest CVSS first.
Infrastructure patterns
- ORB networks of compromised SOHO routers, IoT devices and leased VPSs hide its C2 (MITRE ATT&CK, 2026)
- Dropbox as a full C2 and exfiltration channel; GitHub hosts malware linked from spearphishing (MITRE ATT&CK, 2026)
- Exploit domains that redirect to real sites; GemStone uses a Cloudflare Worker as C&C, as TA412 (Proofpoint, 2026)
Reporting and advisories 6
- DoJ
Indictment — Seven Wuhan XRZ Hackers / APT31 (2024) - NÚKIB / Czech Government national attribution
Czech Ministry of Foreign Affairs unclassified network intrusion - Microsoft Threat Intelligence
SharePoint on-prem exploitation (ToolShell wave) - Positive Technologies ESC 'Striking Panda'
Russian IT contractors & government integrators — cloud-C2 intrusions - MITRE ATT&CK
Zirconium (G0128) group profile - Proofpoint
Once in a BlueMoon: state-aligned actors adopt a Chrome/Windows zero-day chain (9 Sep 2026)