modified: 2025-04-04T17:08:55.617Z
name: Ke3chang
description: [Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)
aliases: Ke3chang
APT15
Mirage
Vixen Panda
GREF
Playful Dragon
RoyalAPT
NICKEL
Nylon Typhoon
x_mitre_deprecated: no
x_mitre_version: 3.1
x_mitre_contributors: Pooja Natarajan, NEC Corporation India
Manikantan Srinivasan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c
created: 2017-05-31T21:31:47.177Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0004
external_id: G0004
source_name: RoyalAPT
description: (Citation: APT15 Intezer June 2018)
source_name: NICKEL
description: (Citation: Microsoft NICKEL December 2021)
source_name: Nylon Typhoon
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: APT15
description: (Citation: NCC Group APT15 Alive and Strong)
source_name: Mirage
description: (Citation: NCC Group APT15 Alive and Strong)
source_name: GREF
description: (Citation: NCC Group APT15 Alive and Strong)
source_name: Vixen Panda
description: (Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)
source_name: Playful Dragon
description: (Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)
source_name: Ke3chang
description: (Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft NICKEL December 2021
description: MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.
url: https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe
source_name: APT15 Intezer June 2018
description: Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.
url: https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/
source_name: NCC Group APT15 Alive and Strong
description: Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
url: https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
source_name: Mandiant Operation Ke3chang November 2014
description: Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
url: https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs
source_name: Villeneuve et al 2014
description: Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
url: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5