{
  "id": "zirconium",
  "name": "ZIRCONIUM",
  "aliases": [
    "APT31",
    "Violet Typhoon"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Operates from China",
      "src": [
        "mitre-g0128"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2017,
      "src": [
        "mitre-g0128"
      ],
      "conf": "medium",
      "note": "At least 2017"
    },
    {
      "k": "attack_id",
      "v": "G0128",
      "src": [
        "mitre-g0128"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community.",
      "src": [
        "mitre-g0128"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 29,
      "src": [
        "mitre-g0128"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "ZIRCONIUM is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0128)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/zirconium.html",
  "sources": {
    "mitre-g0128": {
      "title": "ZIRCONIUM, Group G0128",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0128/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}