AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Ke3chang
Aliases: APT15, GREF, Ke3chang, Mirage, NICKEL, Nylon Typhoon, Playful Dragon, RoyalAPT, Vixen Panda
[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)
Open interactive actor investigation
ATT&CK techniques
T1003.001T1003.002T1003.003T1003.004T1005T1007T1016T1018T1020T1021.002T1027T1033T1036.002T1036.005T1041T1049T1056.001T1057T1059T1059.003T1069.002T1071.001T1071.004T1078T1078.004T1082T1083T1087.001T1087.002T1105T1114.002T1119T1133T1140T1190T1213.002T1543.003T1547.001T1558.001T1560T1560.001T1569.002T1583.005T1587.001T1588.002T1614.001
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Systeminfo tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ping tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ipconfig tool reference — Explicit actor uses software relationship in pinned ATT&CK
- netstat tool reference — Explicit actor uses software relationship in pinned ATT&CK
- spwebmember tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.002 Security Account Manager simulation — Exact active technique ID
- T1003.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.004 LSA Secrets simulation — Exact active technique ID
- T1003.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1007 System Service Discovery simulation — Exact active technique ID
- T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1020 Automated Exfiltration simulation — Exact active technique ID
- T1020 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.002 SMB/Windows Admin Shares simulation — Exact active technique ID
- T1021.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027 Obfuscated Files or Information simulation — Exact active technique ID
- T1027 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1033 System Owner/User Discovery simulation — Exact active technique ID
- T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.002 Right-to-Left Override simulation — Exact active technique ID
- T1036.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
- T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059 Command and Scripting Interpreter simulation — Exact active technique ID
- T1059 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1069.002 Domain Groups simulation — Exact active technique ID
- T1069.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.004 DNS simulation — Exact active technique ID
- T1071.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.001 Local Account simulation — Exact active technique ID
- T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1114.002 Remote Email Collection simulation — Exact active technique ID
- T1114.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1213.002 Sharepoint simulation — Exact active technique ID
- T1213.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1543.003 Windows Service simulation — Exact active technique ID
- T1543.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1558.001 Golden Ticket simulation — Exact active technique ID
- T1558.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1569.002 Service Execution simulation — Exact active technique ID
- T1569.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.005 Botnet simulation — Exact active technique ID
- T1583.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.001 Malware simulation — Exact active technique ID
- T1587.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1614.001 System Language Discovery simulation — Exact active technique ID
- T1614.001 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-nameDefensive external attack-surface discovery and continuous monitoring
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name