Ke3chang G0004

Also known as: APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

associated CVEs

Techniques

Malware and tools

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2022-27518 Critical · 9.8 KEV Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

“SPACEHOP Activity: SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.”

Techniques by tactic

Resource Development

T1583.005 Botnet T1587.001 Malware T1588.002 Tool

Initial Access

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application

Execution

T1059 Command and Scripting Interpreter T1059.003 Windows Command Shell T1569.002 Service Execution

Persistence

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1078 Valid Accounts T1078.004 Cloud Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or Information T1036.002 Right-to-Left Override T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.004 Cloud Accounts T1140 Deobfuscate/Decode Files or Information

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1056.001 Keylogging T1558.001 Golden Ticket

Discovery

T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1614.001 System Language Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Collection

T1005 Data from Local System T1056.001 Keylogging T1114.002 Remote Email Collection T1119 Automated Collection T1213.002 Sharepoint T1560 Archive Collected Data T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer

Exfiltration

T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel

Malware and tools

MirageFoxMalwareS0280
NeoichorMalwareS0691
OkrumMalwareS0439
ipconfigToolS0100
MimikatzToolS0002
NetToolS0039
netstatToolS0104
PingToolS0097
spwebmemberToolS0227
SysteminfoToolS0096
TasklistToolS0057