How the Chinese group APT31 infiltrated Russia’s IT industry?

APT31, a hacking group linked to China, launched several cyberattacks on Russia’s IT sector between 2024 and 2025. They entered quietly, remaining hidden from the radar for a long time.

Positive Technologies researchers Daniel Grigoryan and Varvara Koloskova put it this way: “Between 2024 and 2025, Russia’s IT sector – especially contractors and solution integrators working with government agencies – will face a wave of targeted computer attacks.”

APT31: Many names, one motive

APT31 has many aliases: Altair, Bronze Vinewood, Judgment Panda, Perplexed Goblin, Redbravo, Redcaress, and Violet Typhoon (formerly known as Zirconium). People have tracked this group since at least 2010. They aren’t limited to just one field. Government agencies, banks, aerospace and defense companies, high-tech firms, construction, telecom, media, insurance, you name it, they’ve probably tried to break in.

The group’s primary goal is clear: to take control of anything that benefits Beijing and its state-owned companies, whether political, economic, or military. In fact, in May 2025, the Czech Republic accused them of hacking its Foreign Ministry in 2022.

New strategy of attacks in Russia

Attacks in Russia are often concealed behind legitimate cloud services, particularly local services like Yandex Cloud, to appear as normal traffic and evade security for command-and-control operations and data theft.

The attackers didn’t stop there. They injected encrypted commands and malware into social media accounts, both domestically and abroad. They also preferred to attack when people were less alert, and they increased their activity during weekends and holidays. Take APT31, for example. They breached an IT company’s network in late 2022, then really ramped up during the New Year holidays in 2023.

In December 2024, attackers infiltrated via a spear-phishing email. They hid a RAR file inside, and within that archive was a Windows shortcut (an LNK file) designed to launch a Cobalt Strike loader called CloudyLoader using DLL side-loading. Kaspersky first reported this in July 2025 and noted that some of the tactics matched those of a group called EastWind.

Kaspersky also observed another trick: a ZIP archive used as bait, which also caused CloudyLoader to drop. Peru’s Ministry of Foreign Affairs reported that incident.

To facilitate the later stages of the attack cycle, APT31 has used a wide range of publicly available and custom tools. Persistence is achieved by setting up scheduled tasks that mimic legitimate applications such as Yandex Disk and Google Chrome.

APT31 continues to add new tools

APT31 continues to add new tools to its lineup, but it still relies on some of its old favorites. They use cloud services for command and control, Yandex and Microsoft OneDrive. Many of their tools run in server mode, essentially idling until attackers decide to connect to infected machines.

They also extract data directly from Yandex’s cloud storage. This mix of tools and tricks helps APT31 remain hidden within victims’ networks for years. While lurking, they quietly extract files and sensitive information from devices, including passwords to email accounts and internal services.

Frequently Asked Questions (FAQs)