Ke3chang
Ke3chang is a China-aligned cyber espionage threat actor. The provided content associates Ke3chang with the aliases APT15, Nickel, Nylon Typhoon, Flea, Mirage, Playful Dragon, Playful Taurus, RoyalAPT, Vixen Panda, GREF, Metushy, Red Vulture, and Social Network Team. The content also notes reporting that BadBazaar was attributed by Lookout to APT15, but separately states that attribution should be limited to GREF and that a link between GREF and APT15 could not be confirmed, indicating aliasing in this area is not fully resolved. Based on the content, Ke3chang has targeted at least a Canadian mining company in 2021. Its tradecraft includes persistence via Registry Run keys and batch scripts; process discovery using tasklist; command execution through the Windows command-line interface; collection of system language ID from compromised machines; use of credential theft tooling such as Mimikatz; gathering of information and files from local directories for exfiltration; and transfer of compressed and encrypted RAR archives over an established backdoor command-and-control channel. The actor has also dropped malware into legitimate installed software paths, including under Realtek, Foxit Reader, Adobe Flash Player, and Adobe Acrobat Reader directories.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
60 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
48 malware families attributed to this actor across reporting.
43 additional families tracked in Mallory.
Associated vulnerabilities
15 CVEs this actor has used in observed campaigns. 15 of them exploited in the wild.
GREF was particularly active in the 2010 then it used different 0-day exploits, including CVE-2010-0806, CVE-2010-1297 and CVE-2010-2884 in its attacks.
The intruders gained initial access by chaining two critical Ivanti bugs, CVE-2024-8963 and CVE-2024-8190, days before they were publicly disclosed.
The intruders gained initial access by chaining two critical Ivanti bugs, CVE-2024-8963 and CVE-2024-8190, days before they were publicly disclosed.
GREF was particularly active in the 2010 then it used different 0-day exploits, including CVE-2010-0806, CVE-2010-1297 and CVE-2010-2884 in its attacks.
GREF was particularly active in the 2010 then it used different 0-day exploits, including CVE-2010-0806, CVE-2010-1297 and CVE-2010-2884 in its attacks.
10 more CVEs tied to this actor tracked in Mallory.
Observables
92 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an affiliate ecosystem previously associated with Nimbus RAT activity; in this content, the group is linked indirectly through prior documentation rather than identified as the actor conducting the current campaign.
Associated with affiliate activity using Nimbus RAT in social-engineering intrusions involving Microsoft Teams vishing and remote access.
Chinese cyberespionage activity targeting the mining sector, including a Canadian mining company, in support of strategic interest in critical minerals and embodied AI supply chains.
Exploited CVE-2010-0806 as a zero-day in targeted attacks.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.