{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt31",
    "slug": "apt31",
    "name": "APT31",
    "shortName": "APT31",
    "country": "China",
    "countryCode": "CN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2010",
    "prominence": 81,
    "mitreGroupId": "G0128",
    "tagline": "MSS Hubei bureau targeting politicians, election infrastructure, and dissidents — sanctioned by both the U.S. and U.K. in March 2024.",
    "bio": "APT31 focuses on political intelligence: legislators, election infrastructure, campaign staff, dissidents and their families, and the think tanks that shape policy on China.\n\nIts most distinctive technique is reconnaissance at scale through tracking pixels. Rather than sending malware, operators send tens of thousands of benign-looking emails containing an embedded remote image. When a message is opened, the request to the attacker's server reveals the recipient's IP address, browser, operating system, and device — enough to map a target's location and infrastructure without any code execution and without tripping a single security control. The UK government has stated this technique was used against parliamentarians who had been critical of China.\n\nIn March 2024 the U.S. and U.K. acted in coordination. The Department of Justice unsealed an indictment of seven individuals, identifying Wuhan Xiaoruizhi Science and Technology Company as a front for the Hubei State Security Department; the U.S. and U.K. imposed sanctions the same day, with the U.K. citing the group's compromise of the Electoral Commission — which exposed the register data of roughly 40 million voters — and the targeting of parliamentarians.",
    "attribution": {
      "sponsor": "China",
      "service": "Ministry of State Security (MSS) — Hubei State Security Department",
      "unit": "Wuhan Xiaoruizhi Science and Technology Company (front company)",
      "confidence": "confirmed",
      "summary": "Seven Chinese nationals were indicted by the U.S. Department of Justice in March 2024 for a fourteen-year campaign against U.S. and foreign critics, businesses, and political officials. The indictment identifies Wuhan Xiaoruizhi Science and Technology Company as a front for the Hubei State Security Department, a provincial arm of the MSS. The U.S. Treasury and the U.K. FCDO imposed coordinated sanctions the same day, with the U.K. attributing the Electoral Commission compromise and the targeting of parliamentarians to the group.",
      "sources": [
        {
          "org": "U.S. Department of Justice",
          "title": "Seven Hackers Associated with Chinese Government Charged with Computer Intrusions Targeting Perceived Critics of China",
          "url": "https://www.justice.gov/opa/pr/seven-hackers-associated-chinese-government-charged-computer-intrusions-targeting-perceived",
          "date": "2024-03-25"
        },
        {
          "org": "UK Foreign, Commonwealth & Development Office / NCSC",
          "title": "UK holds China state-affiliated organisations and individuals responsible for malicious cyber activity",
          "url": "https://www.gov.uk/government/news/uk-holds-china-state-affiliated-organisations-and-individuals-responsible-for-malicious-cyber-activity",
          "date": "2024-03-25"
        }
      ]
    },
    "motivations": [
      "espionage",
      "information-operations"
    ],
    "targetSectors": [
      "Government",
      "Political Organizations",
      "Think Tanks & Academia",
      "Defense",
      "NGO & Civil Society",
      "Media & Journalism",
      "Technology",
      "Legal",
      "Aerospace"
    ],
    "targetCountries": [
      "United States",
      "United Kingdom",
      "Finland",
      "Norway",
      "Germany",
      "France",
      "Czechia",
      "Australia",
      "New Zealand"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "APT31",
        "url": "https://attack.mitre.org/groups/G0128/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Violet Typhoon",
        "correlation": "exact",
        "note": "Formerly ZIRCONIUM"
      },
      {
        "org": "microsoft",
        "name": "ZIRCONIUM",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Judgment Panda",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT31",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "BRONZE VINEWOOD",
        "correlation": "exact"
      },
      {
        "org": "proofpoint",
        "name": "TA412",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "APT31 / Hubei State Security Department",
        "correlation": "exact"
      },
      {
        "org": "recordedfuture",
        "name": "RedBravo",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "Tracking pixels",
        "type": "utility",
        "custom": false,
        "description": "Remote images embedded in benign emails, revealing recipient IP, browser, and device on open — reconnaissance with no code execution and no detectable payload."
      },
      {
        "name": "RAWDOOR",
        "type": "backdoor",
        "custom": true,
        "description": "Custom implant used for durable access to compromised networks."
      },
      {
        "name": "Trochilus",
        "type": "backdoor",
        "custom": false,
        "description": "Open-source RAT customised by the group for in-memory operation."
      },
      {
        "name": "DropboxAES",
        "type": "backdoor",
        "custom": true,
        "description": "Backdoor using Dropbox for C2, blending exfiltration with normal cloud traffic."
      },
      {
        "name": "Compromised routers",
        "type": "utility",
        "custom": false,
        "description": "Hijacked home and small-business routers used as C2 relays inside victim geographies."
      },
      {
        "name": "Cobalt Strike",
        "type": "framework",
        "custom": false,
        "description": "Post-exploitation framework used for interactive access."
      }
    ],
    "techniques": [
      {
        "tCode": "T1598.002",
        "name": "Phishing for Information: Spearphishing Attachment",
        "tactic": "Reconnaissance",
        "note": "Tracking-pixel emails at very high volume for target mapping"
      },
      {
        "tCode": "T1566.002",
        "name": "Phishing: Spearphishing Link",
        "tactic": "Initial Access",
        "note": "Personas impersonating journalists and researchers"
      },
      {
        "tCode": "T1190",
        "name": "Exploit Public-Facing Application",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1584.005",
        "name": "Compromise Infrastructure: Botnet",
        "tactic": "Resource Development",
        "note": "Compromised SOHO routers as in-country relays"
      },
      {
        "tCode": "T1102",
        "name": "Web Service",
        "tactic": "Command and Control",
        "note": "Dropbox and other cloud services as C2 channels"
      },
      {
        "tCode": "T1114.002",
        "name": "Email Collection: Remote Email Collection",
        "tactic": "Collection"
      },
      {
        "tCode": "T1213",
        "name": "Data from Information Repositories",
        "tactic": "Collection",
        "note": "Voter registration and membership databases"
      },
      {
        "tCode": "T1078",
        "name": "Valid Accounts",
        "tactic": "Persistence"
      },
      {
        "tCode": "T1071.001",
        "name": "Application Layer Protocol: Web Protocols",
        "tactic": "Command and Control"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2021-26855",
        "firstExploited": "2021-03-01",
        "usage": "ProxyLogon exploited against Exchange servers following the HAFNIUM disclosure.",
        "source": {
          "org": "ESET",
          "title": "Exchange servers under siege from at least 10 APT groups",
          "url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/",
          "date": "2021-03-10"
        }
      },
      {
        "cveId": "CVE-2021-34473",
        "firstExploited": "2021-08-01",
        "usage": "ProxyShell exploitation of Exchange servers, including the intrusion into the UK Electoral Commission's systems.",
        "source": {
          "org": "UK Electoral Commission",
          "title": "Public notification of cyber-attack on Electoral Commission systems",
          "url": "https://www.electoralcommission.org.uk/privacy-policy/cyber-attack-electoral-commission-systems",
          "date": "2023-08-08"
        }
      },
      {
        "cveId": "CVE-2017-0199",
        "firstExploited": "2018-05-01",
        "usage": "OLE2link RTF exploit in phishing against government and policy targets.",
        "source": {
          "org": "Proofpoint",
          "title": "TA412 targeting of US-based media and government",
          "url": "https://www.proofpoint.com/us/blog/threat-insight/above-us-only-stars-exposing-ghostwriter",
          "date": "2022-08-18"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "silk-typhoon",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both MSS provincial-bureau operations run through named front companies; both exploited Exchange in 2021."
      },
      {
        "relatedActorId": "apt40",
        "type": "same-sponsor",
        "confidence": "moderate",
        "note": "Both provincial MSS bureaus — Hubei and Hainan respectively — using the same front-company model."
      }
    ],
    "reports": [
      {
        "org": "U.S. Department of Justice",
        "title": "Indictment: Seven APT31 hackers — Wuhan Xiaoruizhi / Hubei SSD",
        "url": "https://www.justice.gov/opa/media/1344941/dl",
        "date": "2024-03-25"
      },
      {
        "org": "UK NCSC / FCDO",
        "title": "UK holds China state-affiliated organisations responsible for malicious cyber activity",
        "url": "https://www.gov.uk/government/news/uk-holds-china-state-affiliated-organisations-and-individuals-responsible-for-malicious-cyber-activity",
        "date": "2024-03-25"
      },
      {
        "org": "Google Threat Analysis Group",
        "title": "Election-related phishing targeting US campaign staff",
        "url": "https://blog.google/technology/safety-security/updating-our-election-security-work/",
        "date": "2020-06-04"
      }
    ],
    "campaigns": [
      {
        "id": "electoral-commission",
        "actorId": "apt31",
        "name": "UK Electoral Commission Compromise",
        "date": "2021-08-01",
        "endDate": "2022-10-01",
        "significance": "major",
        "targetSectors": [
          "Government",
          "Political Organizations"
        ],
        "targetCountries": [
          "United Kingdom"
        ],
        "cveIds": [
          "CVE-2021-34473"
        ],
        "summary": "Compromise of the UK Electoral Commission's systems, exposing register data covering roughly 40 million voters. Attributed by the UK government in March 2024 alongside the targeting of parliamentarians who had been critical of China, and met with coordinated UK and U.S. sanctions.",
        "sources": [
          {
            "org": "UK FCDO / NCSC",
            "title": "UK holds China state-affiliated organisations responsible for malicious cyber activity",
            "url": "https://www.gov.uk/government/news/uk-holds-china-state-affiliated-organisations-and-individuals-responsible-for-malicious-cyber-activity",
            "date": "2024-03-25"
          }
        ]
      }
    ],
    "flag": "🇨🇳",
    "profile": "/apt/apt31/"
  }
}