Threat Actors Ke3chang

Ke3chang

G0004 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon, Ke3Chang, Social Network Team, Mirage Team, Lurid, Royal APT, Metushy, Winnti Umbrella, BRONZE PALACE, BRONZE DAVENPORT, BRONZE IDLEWOOD, G0004, Red Vulture, TG-3279, China Cracking Group, RIVER CASTLE

Description

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

TTP Summary

Umbrella Revolution

Goals & Targeting

Targeted Sectors

Government

Gaming

Targeted Countries / Regions

AI Analysis

· 1 week ago

Executive Summary

Ke3chang is a Chinese-based advanced persistent threat (APT) group known for espionage activities targeting government, diplomatic, military, and gaming sectors globally since at least 2010. The group has been linked to multiple aliases and campaigns, including 'Mirage Team,' 'NICKEL,' and 'Umbrella Revolution.' Ke3chang employs a wide range of tactics, techniques, and procedures (TTPs) to infiltrate victim networks, collect sensitive data, and maintain long-term access.

Goals & Targeting

Ke3 chang's primary strategic objective appears to be gathering intelligence and sensitive information from targeted sectors such as government, military, and gaming industries. The group's focus on these sectors suggests a desire to acquire geopolitical, defense-related, and potentially commercially valuable data. Targeted countries include the United States, South America, Europe, and others, indicating a global scope of operations. The group likely operates under the direction of Chinese state interests, aiming to support national security or economic goals.

Enhanced Description

Ke3chang is a state-sponsored cyberespionage group attributed to Chinese actors. The group has demonstrated significant operational persistence since its first identification by Mandiant in 2014 as Operation Ke3 Chang. Known for its ties to the Chinese government, Ke3chang primarily focuses on stealing sensitive information from diplomatic entities, defense contractors, and critical infrastructure sectors such as energy and gaming industries. Over the years, the group has expanded its targeting to include not just traditional espionage targets but also global organizations in Central and South America, Europe, and North America. The group's TTPs include extensive use of credential theft, lateral movement within networks, and persistence mechanisms that leverage Windows-based techniques. Its toolset includes custom malware and scripts designed for long-term access and data exfiltration. Despite its long operational history, Ke3chang has managed to remain under the radar in many cases due to its sophisticated TTPs.

Key Capabilities

Spear-phishing with malicious attachments
Credential theft
Lateral network movement
Data exfiltration via custom tools
Domain and account compromise
Persistence mechanisms

MITRE ATT&CK Tactics

Credential Access

Discovery

Exfiltration

Persistence

ATT&CK Techniques

T1059.003

T1213.002

T1087.002

T1041

T1543

T1005

T1614.001

T1558.001

Software / Tooling

Okrum

MirageFox

Neoichor

Custom malware

Campaigns & Victims

Ke3chang has been involved in several high-profile campaigns, including Operation Ke3 Chang identified by Mandiant and APT15 activities noted by multiple security firms. The group often targets organizations with spear-phishing emails, deploying custom tools to gain initial access before using a range of techniques to expand across networks. Campaigns frequently involve long-term驻留 within victim networks, enabling sustained data collection and exfiltration over time. Notable operations have targeted oil and gas industries, government agencies, and gaming companies globally.

IOC Patterns

Spear-phishing emails with malicious Office documents
Lateral movement using Windows command-line executables
Exfiltration through encrypted channels or legitimate cloud services
Malicious scripts dropped via web protocols
Credential dumping operations targeting domain accounts

Recommended Actions

Implement multi-layered email filtering to detect and block spear-phishing attempts.
Monitor for unusual network activity, especially lateral movement patterns indicative of APT behavior.
Enhance credential protection with MFA (Multi-Factor Authentication) and regular password audits.
Deploy endpoint detection and response (EDR) solutions to detect malicious scripts and processes.
Conduct regular red team exercises simulating APT tactics to improve incident response readiness.

Suggested Tags

APT

espionage

state-sponsored

gaming-sector

government-targeting

Confidence Assessment

High confidence in Ke3chang's existence and activity due to multiple independent reports from reputable security firms, including Mandiant and Microsoft. However, details regarding the group's recent activities beyond 2021 are limited, and specific campaign attributes may require further confirmation.

ATT&CK Techniques

Collection

7 techniques

T1005

Data from Local System

Ke3chang gathered information and files from local directories for exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)

T1056.001

Keylogging

Ke3chang has used keyloggers.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1114.002

Remote Email Collection

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1119

Automated Collection

Ke3chang has performed frequent and scheduled data collection from victim networks.(Citation: Microsoft NICKEL December 2021)

T1213.002

Sharepoint

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.(Citation: NCC Group APT15 Alive and Strong)

T1560

Archive Collected Data

The Ke3chang group has been known to compress data before exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)

T1560.001

Archive via Utility

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)

Command & Control

3 techniques

T1071.001

Web Protocols

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1071.004

DNS

Ke3chang malware RoyalDNS has used DNS for C2.(Citation: NCC Group APT15 Alive and Strong)

T1105

Ingress Tool Transfer

Ke3chang has used tools to download files to compromised machines.(Citation: Microsoft NICKEL December 2021)

Credential Access

5 techniques

T1003.001

LSASS Memory

Ke3chang has dumped credentials, including by using Mimikatz.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1003.002

Security Account Manager

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

T1003.003

NTDS

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.(Citation: Microsoft NICKEL December 2021)

T1003.004

LSA Secrets

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

T1558.001

Golden Ticket

Ke3chang has used Mimikatz to generate Kerberos golden tickets.(Citation: NCC Group APT15 Alive and Strong)

Discovery

12 techniques

T1007

System Service Discovery

Ke3chang performs service discovery using <code>net start</code> commands.(Citation: Mandiant Operation Ke3chang November 2014)

T1016

System Network Configuration Discovery

Ke3chang has performed local network configuration discovery using <code>ipconfig</code>.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1018

Remote System Discovery

Ke3chang has used network scanning and enumeration tools, including Ping.(Citation: NCC Group APT15 Alive and Strong)

T1033

System Owner/User Discovery

Ke3chang has used implants capable of collecting the signed-in username.(Citation: Microsoft NICKEL December 2021)

T1049

System Network Connections Discovery

Ke3chang performs local network connection discovery using <code>netstat</code>.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

T1057

Process Discovery

Ke3chang performs process discovery using <code>tasklist</code> commands.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

T1069.002

Domain Groups

Ke3chang performs discovery of permission groups <code>net group /domain</code>.(Citation: Mandiant Operation Ke3chang November 2014)

T1082

System Information Discovery

Ke3chang performs operating system information discovery using <code>systeminfo</code> and has used implants to identify the system language and computer name.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1083

File and Directory Discovery

Ke3chang uses command-line interaction to search files and directories.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)

T1087.001

Local Account

Ke3chang performs account discovery using commands such as <code>net localgroup administrators</code> and <code>net group "REDACTED" /domain</code> on specific permissions groups.(Citation: Mandiant Operation Ke3chang November 2014)

T1087.002

Domain Account

T1614.001

System Language Discovery

Ke3chang has used implants to collect the system language ID of a compromised machine.(Citation: Microsoft NICKEL December 2021)

Execution

3 techniques

T1059

Command and Scripting Interpreter

Malware used by Ke3chang can run commands on the command-line interface.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

T1059.003

Windows Command Shell

Ke3chang has used batch scripts in its malware to install persistence mechanisms.(Citation: NCC Group APT15 Alive and Strong)

T1569.002

Service Execution

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.(Citation: NCC Group APT15 Alive and Strong)

Exfiltration

2 techniques

T1020

Automated Exfiltration

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.(Citation: Microsoft NICKEL December 2021)

T1041

Exfiltration Over C2 Channel

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.(Citation: Mandiant Operation Ke3chang November 2014)

Initial Access

1 technique

T1190

Exploit Public-Facing Application

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.(Citation: Microsoft NICKEL December 2021)

Lateral Movement

1 technique

T1021.002

SMB/Windows Admin Shares

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)

Persistence

3 techniques

T1133

External Remote Services

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)

T1543.003

Windows Service

Ke3chang backdoor RoyalDNS established persistence through adding a service called <code>Nwsapagent</code>.(Citation: NCC Group APT15 Alive and Strong)

T1547.001

Registry Run Keys / Startup Folder

Several Ke3chang backdoors achieved persistence by adding a Run key.(Citation: NCC Group APT15 Alive and Strong)

Resource Development

3 techniques

T1583.005

Botnet

Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.(Citation: ORB Mandiant)

T1587.001

Malware

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)

T1588.002

Tool

Ke3chang has obtained and used tools such as Mimikatz.(Citation: NCC Group APT15 Alive and Strong)

Stealth

6 techniques

T1027

Obfuscated Files or Information

Ke3chang has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)

T1036.002

Right-to-Left Override

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.(Citation: Mandiant Operation Ke3chang November 2014)

T1036.005

Match Legitimate Resource Name or Location

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.(Citation: Microsoft NICKEL December 2021)

T1078

Valid Accounts

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.(Citation: Microsoft NICKEL December 2021)

T1078.004

Cloud Accounts

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.(Citation: Microsoft NICKEL December 2021)

T1140

Deobfuscate/Decode Files or Information

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.(Citation: Microsoft NICKEL December 2021)

Software / Tooling

S0014

BS2005

Family

CYFREE

ENDCMD

Enfal

Mirage

MirageFox

(Citation: APT15 Intezer June 2018)

NOISEMAKER

S0691

Neoichor

Family

(Citation: Microsoft NICKEL December 2021)

S0439

Okrum

Family

(Citation: ESET Okrum July 2019)

PlugX

QuickHeal

RoyalCli

Russian-language decoy document

SOGU

SWALLOWFLY

Tidepool

XSLCmd

iWebRat

Campaigns / Victims

All campaigns →

Active

Umbrella Revolution

TLP:CLEAR

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

Microsoft Threat Actor Naming July 2023 — Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Microsoft NICKEL December 2021 — MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
APT15 Intezer June 2018 — Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.
NCC Group APT15 Alive and Strong — Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
Mandiant Operation Ke3chang November 2014 — Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
Villeneuve et al 2014 — Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G0004
Type: Unknown
Resource Level: Government
Primary Motivation: Espionage
Country of Origin: China (CN)
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.