Ke3chang G0004

Também conhecido como: APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

CVEs associadas

Técnicas

Malwares e ferramentas

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2022-27518 Crítica · 9.8 KEV Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass Vulnerability

“SPACEHOP Activity: SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.”

Técnicas por tática

Desenvolvimento de recursos

T1583.005 Botnet T1587.001 Malware T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application

Execução

T1059 Command and Scripting Interpreter T1059.003 Windows Command Shell T1569.002 Service Execution

Persistência

T1078 Valid Accounts T1078.004 Cloud Accounts T1133 External Remote Services T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1078 Valid Accounts T1078.004 Cloud Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027 Obfuscated Files or Information T1036.002 Right-to-Left Override T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.004 Cloud Accounts T1140 Deobfuscate/Decode Files or Information

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1056.001 Keylogging T1558.001 Golden Ticket

Descoberta

T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1087.002 Domain Account T1614.001 System Language Discovery

Movimento lateral

T1021.002 SMB/Windows Admin Shares

Coleta

T1005 Data from Local System T1056.001 Keylogging T1114.002 Remote Email Collection T1119 Automated Collection T1213.002 Sharepoint T1560 Archive Collected Data T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1071.004 DNS T1105 Ingress Tool Transfer

Exfiltração

T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel

Malwares e ferramentas

MirageFoxMalwareS0280
NeoichorMalwareS0691
OkrumMalwareS0439
ipconfigFerramentaS0100
MimikatzFerramentaS0002
NetFerramentaS0039
netstatFerramentaS0104
PingFerramentaS0097
spwebmemberFerramentaS0227
SysteminfoFerramentaS0096
TasklistFerramentaS0057