ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|PRE|T1598|Phishing for Information|

ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.(Citation: Google Election Threats October 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

ZIRCONIUM has used Python-based implants to interact with compromised hosts.(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

ZIRCONIUM has used malicious links in e-mails to deliver malware.(Citation: Microsoft Targeting Elections September 2020)(Citation: Google Election Threats October 2020)(Citation: Zscaler APT31 Covid-19 October 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

ZIRCONIUM has purchased domains for use in targeted campaigns.(Citation: Microsoft Targeting Elections September 2020)|