Threat intelligence / Group

Ke3chang

[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

58 recorded

Relationships

attributed-to

from SPACEHOP Activity

Campaign

uses

to Archive Collected Data

Technique

uses

to Archive via Utility

Technique

uses

to Automated Collection

Technique

uses

to Automated Exfiltration

Technique

uses

Technique

uses

to Cloud Accounts

Technique

uses

to Command and Scripting Interpreter

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DNS

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to Golden Ticket

Technique

uses

to Ingress Tool Transfer

Technique

uses

Tool

uses

Technique

uses

to Local Account

Technique

uses

Technique

uses

to LSASS Memory

Technique

uses

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

Tool

uses

Malware

uses

Malware

uses

to Net

Tool

uses

Tool

uses

Technique

uses

to Obfuscated Files or Information

Technique

uses

Malware

uses

Tool

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Remote Email Collection

Technique

uses

to Remote System Discovery

Technique

uses

to Right-to-Left Override

Technique

uses

to Security Account Manager

Technique

uses

to Service Execution

Technique

uses

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

Tool

uses

Tool

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

Tool

uses

Technique

uses

to Valid Accounts

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Service

Technique

16 external

References

mitre-attack

G0004

RoyalAPT

—

NICKEL

—

Nylon Typhoon

—

APT15

—

Mirage

—

GREF

—

Vixen Panda

—

Playful Dragon

—

Ke3chang

—

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

Microsoft NICKEL December 2021

https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe

APT15 Intezer June 2018

https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/

NCC Group APT15 Alive and Strong

https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

Mandiant Operation Ke3chang November 2014

https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs

Villeneuve et al 2014

https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf