Ke3chang
IntrusionSet · ATTACK:enterprise:G0004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0004",
"title": "Ke3chang",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c",
"external_id": "G0004",
"domain": "enterprise",
"created": "2017-05-31T21:31:47.177Z",
"modified": "2026-07-31T18:47:59.619Z",
"version": "3.1",
"aliases": [
"Ke3chang",
"APT15",
"Mirage",
"Vixen Panda",
"GREF",
"Playful Dragon",
"RoyalAPT",
"NICKEL",
"Nylon Typhoon"
],
"tactics": [
],
"source_references": [
{
"source_name": "RoyalAPT"
},
{
"source_name": "NICKEL"
},
{
"source_name": "Nylon Typhoon"
},
{
"source_name": "APT15"
},
{
"source_name": "Mirage"
},
{
"source_name": "GREF"
},
{
"source_name": "Vixen Panda"
},
{
"source_name": "Playful Dragon"
},
{
"source_name": "Ke3chang"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft NICKEL December 2021",
"url": "https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"
},
{
"source_name": "APT15 Intezer June 2018",
"url": "https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"
},
{
"source_name": "NCC Group APT15 Alive and Strong",
"url": "https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
},
{
"source_name": "Mandiant Operation Ke3chang November 2014",
"url": "https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"
},
{
"source_name": "Villeneuve et al 2014",
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf"
}
]
}Explicit source assertions (58)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1114.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--021885d8-90a5-4d70-91de-869783cd57d3
NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d51acf9-f8df-42e1-aef3-4c86cf5ab17a
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0439
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ee0af6e-c913-406e-9439-f40f5102cae7
ESET Okrum July 2019ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1525d82a-05a7-4027-9d2d-02f8039d68b5
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15cccbec-2d40-4f28-a46e-c985bbb20c87
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--199c92d9-dd54-4cb1-beef-3b6a97d12e82
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a15d017-485e-403b-bad8-da8da074ffed
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20f863a1-f7de-4d66-a564-c4adee24fdbe
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--301de16e-3829-4fb0-b217-dcdfca7398c9
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--325ccde0-2d5a-4306-9c4e-e1a554ee0d87
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--352e6e5a-f1e0-46f8-826a-978981f6d893
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1558.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42049cfe-e374-4726-9832-3ad01d8466a5
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42d2f816-9db2-47bf-9481-3065d038725d
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0227
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47f580c1-77ea-48a6-a280-71bbcb4707d0
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49f2c182-bd69-4874-9102-b5fd1acac59c
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cf4df8f-9eb3-4136-a082-ea1b5d7b398f
NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53fb076c-5f59-45da-bbc2-94b5f3a3eb91
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--59223275-a57b-45ca-94b6-5c504165d8f9
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c8fba10-9d8a-4257-a458-8f58efc8d912
Mandiant Operation Ke3chang November 2014 · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1133
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--60069193-4573-420f-9b2e-e9a42b95af12
NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--625ebfc0-7aaa-4eaf-8c49-be8b55c059d4
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--644d2862-2836-41dd-ba3f-05e23278a5e6
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0280
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--695a988e-daa3-47d7-bf8d-3539ab992f80
APT15 Intezer June 2018ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fb6c639-cefa-4c7f-af89-26cb5fcd4030
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77f919ce-1a18-4ee5-9979-1c9b818ca973
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77f9936d-1ba7-42a8-879d-1a6e90156366
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78ad31db-6b8e-4433-88b8-49c22994a2ab
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b529102-f95c-4ca1-a5c4-5a3497ab3674
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b8c29ce-dda2-4608-a28f-40aca495048f
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e834bba-4d5d-47b6-b689-b905eba66c0d
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--822688d0-d948-414f-b26a-2110d222a233
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8bfa94cf-4eeb-442c-8f18-25b07cd3cbf5
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c763d80-4c50-4ebd-b2c6-3cad22c55bfa
Mandiant Operation Ke3chang November 2014 · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96a7d789-70a9-42d8-a78e-b7ffd6c9dc69
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1213.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9725630d-a737-43dd-a68f-a09987735846
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a823773-6bcc-4923-8f27-4729e771df2b
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0691
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f1f9c0a-92c2-4517-bb04-db232421284a
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5a63d5c-acf7-4720-866d-fcf6e576a58f
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1036.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5aebe97-98cc-46a5-b3f9-1a0497bc72ba
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1560
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab7eb363-c775-4065-a80d-1b324f22d0b8
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b368c7c2-a593-45cb-b557-aac668a02656
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bde913a9-9895-4414-b79a-3156159033aa
Mandiant Operation Ke3chang November 2014 · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c031bd06-453b-4f80-9a04-98e74a420323
Microsoft NICKEL December 2021ATTACK:enterprise:C0052 → attributed-to → ATTACK:enterprise:G0004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1b3aa1d-ffc8-4ca9-8214-aa671c5d27f6
ORB MandiantATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7e6d4a6-8d99-4134-848a-f4f712eb4316
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8db7b65-563d-47ba-9e06-cabdbade47e9
Microsoft NICKEL December 2021 · NCC Group APT15 Alive and Strong · Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb727277-5491-422f-ab40-1bd1be973d1e
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc79d8c5-f7c9-4c8b-810d-e57d70a07d4f
NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdd38074-895f-40e8-85fb-acc1aa4ecb69
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d150b0e5-9e4b-48c4-a952-5234b3d72c6a
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1583.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d70d3818-39a9-490d-95a4-59fa3a0b313f
ORB MandiantATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcb733f7-0b36-4b25-82d4-c332810562a7
NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eaa06586-e33e-4e4c-91ca-76935c22e012
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f39446a9-07d1-456a-b48b-241aab979e55
NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3d30d20-ee51-4976-8611-5667df771567
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7ed42df-01c4-4441-95ce-68228e157abf
Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f865403f-5b4a-4e5a-bb50-8d416ad36db4
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0100
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f879eea1-2a05-484d-adbb-c3504813fc5d
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and Strong