APT31__2020__BRONZE_VINEWOOD_Targets_Supply_Chains_Secureworks.pdf

This Secureworks CTU report analyzes BRONZE VINEWOOD (APT31/ZIRCONIUM), assessing it as a likely PRC-based espionage group targeting software providers, legal/consulting firms and defense/government supply chains. The report documents observed campaigns and tooling (HanaLoader, DropboxAES RAT, Trochilus, Meterpreter, Mimikatz), delivery and persistence methods (SQL injection, DLL search-order hijacking, scheduled tasks/services), use of public file/code-sharing platforms for C2, credential theft and data exfiltration practices, and provides IoCs and mitigation guidance for defenders.