Ke3chang
- ID
- G0004
- Associated names
- APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]
Techniques used (46)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1007 System Service Discovery
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1020 Automated Exfiltration
- T1021.002 SMB/Windows Admin Shares
- T1027 Obfuscated Files or Information
- T1033 System Owner/User Discovery
- T1036.002 Right-to-Left Override
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1049 System Network Connections Discovery
- T1056.001 Keylogging
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.003 Windows Command Shell
- T1069.002 Domain Groups
- T1071.001 Web Protocols
- T1071.004 DNS
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1087.002 Domain Account
- T1105 Ingress Tool Transfer
- T1114.002 Remote Email Collection
- T1119 Automated Collection
- T1133 External Remote Services
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1213.002 Sharepoint
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1558.001 Golden Ticket
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1569.002 Service Execution
- T1583.005 Botnet
- T1587.001 Malware
- T1588.002 Tool
- T1614.001 System Language Discovery
Software used (11)
- S0002 Mimikatz
- S0039 Net
- S0057 Tasklist
- S0096 Systeminfo
- S0097 Ping
- S0100 ipconfig
- S0104 netstat
- S0227 spwebmember
- S0280 MirageFox
- S0439 Okrum
- S0691 Neoichor