APT15
threat actorCN01
also known as
Other names and identifiers for this entity.
ATT&CK
APT15 · GREF · Ke3chang · Mirage · NICKEL · Nylon Typhoon · Playful Dragon · RoyalAPT · Vixen Panda
MISP
APT15 · BRONZE DAVENPORT · BRONZE IDLEWOOD · BRONZE PALACE · Ke3Chang · Lurid · Metushy · Mirage · NICKEL · Nylon Typhoon · Playful Dragon · RIVER CASTLE · Red Vulture · Royal APT · Social Network Team · VIXEN PANDA
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (46)
ATT&CK techniques this enables or maps to.
showing 20 of 46
04
campaigns (1)
Campaigns that use this.
05
software used (11)
Malware and tools associated with this.
06
references
External citations — patches, advisories, analysis.
- https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html
- http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/
- https://github.com/nccgroup/Royal_APT
- https://www.cfr.org/interactive/cyber-operations/mirage
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf
- https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
- https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/