MITRE ATT&CKgroup
G0004 Ke3chang
- Domain
- enterprise
- Aliases
- APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon
- Version
- 3.1
- Created
- 2017-05-31
Description
Related
Uses · MITRE ATT&CK (57)
- S0691 Neoichor software (malware)
- T1614.001 System Language Discovery sub-technique
- T1583.005 Botnet sub-technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- S0439 Okrum software (malware)
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1003.004 LSA Secrets sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1560 Archive Collected Data technique
- T1560.001 Archive via Utility sub-technique
- T1114.002 Remote Email Collection sub-technique
- T1213.002 Sharepoint sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.002 Security Account Manager sub-technique
- T1003.003 NTDS sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1056.001 Keylogging sub-technique
- T1558.001 Golden Ticket sub-technique
- T1036.002 Right-to-Left Override sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- S0280 MirageFox software (malware)
Referenced by MITRE ATT&CK · attributed to (1)
- C0052 SPACEHOP Activity campaign
References
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe Microsoft NICKEL December 2021
- https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/ APT15 Intezer June 2018
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ NCC Group APT15 Alive and Strong
- https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs Mandiant Operation Ke3chang November 2014
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf Villeneuve et al 2014