G0004 · 45 ATT&CK techniques · 0 correlated reports

Ke3chang

Aliases: APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

Open interactive actor investigation

ATT&CK techniques

T1114.002
Remote Email Collection T1105
Ingress Tool Transfer T1087.001
Local Account T1033
System Owner/User Discovery T1614.001
System Language Discovery T1087.002
Domain Account T1140
Deobfuscate/Decode Files or Information T1558.001
Golden Ticket T1021.002
SMB/Windows Admin Shares T1041
Exfiltration Over C2 Channel T1119
Automated Collection T1083
File and Directory Discovery T1133
External Remote Services T1018
Remote System Discovery T1003.002
Security Account Manager T1016
System Network Configuration Discovery T1588.002
Tool T1020
Automated Exfiltration T1007
System Service Discovery T1543.003
Windows Service T1190
Exploit Public-Facing Application T1036.005
Match Legitimate Name or Location T1569.002
Service Execution T1005
Data from Local System T1071.004
DNS T1213.002
Sharepoint T1027
Obfuscated Files or Information T1059
Command and Scripting Interpreter T1036.002
Right-to-Left Override T1560
Archive Collected Data T1069.002
Domain Groups T1560.001
Archive via Utility T1003.003
NTDS T1057
Process Discovery T1003.001
LSASS Memory T1587.001
Malware T1071.001
Web Protocols T1059.003
Windows Command Shell T1078
Valid Accounts T1547.001
Registry Run Keys / Startup Folder T1049
System Network Connections Discovery T1056.001
Keylogging T1003.004
LSA Secrets T1078.004
Cloud Accounts T1082
System Information Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research