🇨🇳

Mirage

APT Group Information theft and espionage 15 zero-day CVEs ETDA ✓

Also Known As 16 names

APT15 BRONZE DAVENPORT BRONZE IDLEWOOD BRONZE PALACE G0004 Ke3Chang Lurid Metushy NICKEL Nylon Typhoon Playful Dragon Red Vulture Royal APT Social Network Team VIXEN PANDA APT 15

Target Countries 55

Countries highlighted in red

Afghanistan Albania Argentina Bosnia and Herzegovina Barbados Belgium Bulgaria Brazil Bhutan Switzerland Chile China Colombia Germany Dominican Republic Ecuador Egypt France United Kingdom Georgia Ghana Guatemala Honduras Croatia Hungary Indonesia India Islamic Republic of Iran Italy Jamaica Kuwait Kazakhstan Sri Lanka Libya Montenegro Mali Mexico Malaysia Namibia Nigeria Panama Peru Pakistan Poland Portugal Saudi Arabia Slovenia Slovakia El Salvador Turkey Trinidad and Tobago United States Uzbekistan Bolivarian Republic of Venezuela South Africa

Sectors Targeted

Manufacturing Uyghur communities Embassies Government Mining Food Services and Drinking Places 722 High-Tech Energy Computer Systems Design Services 541512 Data Processing, Hosting, and Related Services 51821 Chemical Aviation Aerospace Oil and gas Human Resources Consulting Services 541612 Telecommunications Industrial Utilities Defense

Details

Origin 🇨🇳 CN

Last Updated 06 Aug 2025

Malware Families 10

dilljuice

zhmimikatz

ketrican

ketrum

royal_dns

exchange_tool

royalcli

whitebird

tidepool

bs2005

MITRE ATT&CK 164

T1001 - Data Obfuscation T1003 - OS Credential Dumping T1003.001 T1003.002 T1003.003 - NTDS T1003.004 T1004 - Winlogon Helper DLL T1005 - Data from Local System T1007 - System Service Discovery T1008 T1010 - Application Window Discovery T1011 T1012 - Query Registry T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1020 T1021 T1021.001 - Remote Desktop Protocol T1021.002 - SMB/Windows Admin Shares T1021.006 - Windows Remote Management T1027 - Obfuscated Files or Information T1027.002 - Software Packing T1033 - System Owner/User Discovery T1036 - Masquerading T1036.002 T1036.004 T1036.005 T1038 - DLL Search Order Hijacking T1040 T1041 T1046 T1047 T1048 T1049 T1053 - Scheduled Task/Job T1053.001 - At (Linux) T1053.002 - At (Windows) T1053.003 - Cron T1053.006 - Systemd Timers T1053.007 - Container Orchestration Job T1055 - Process Injection T1055.001 - Dynamic-link Library Injection T1055.002 - Portable Executable Injection T1055.003 - Thread Execution Hijacking T1055.004 - Asynchronous Procedure Call T1055.008 - Ptrace System Calls T1056 - Input Capture T1056.001 - Keylogging T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 T1060 T1069 T1069.002 - Domain Groups T1070 - Indicator Removal on Host T1071 T1071.001 - Web Protocols T1071.004 - DNS T1074 - Data Staged T1074.001 - Local Data Staging T1078 - Valid Accounts T1078.002 - Domain Accounts T1078.004 T1081 T1082 - System Information Discovery T1083 - File and Directory Discovery T1085 T1087 - Account Discovery T1087.001 T1087.002 - Domain Account T1090 T1090.003 T1095 T1102 T1105 - Ingress Tool Transfer T1106 T1112 - Modify Registry T1113 T1114 T1114.001 T1114.002 T1115 - Clipboard Data T1119 T1120 T1124 T1129 - Shared Modules T1130 T1132 - Data Encoding T1133 - External Remote Services T1134 - Access Token Manipulation T1137 T1140 - Deobfuscate/Decode Files or Information T1156 - Malicious Shell Modification T1170 T1190 - Exploit Public-Facing Application T1199 T1201 T1204 T1204.002 T1211 - Exploitation for Defense Evasion T1213 - Data from Information Repositories T1213.002 T1217 T1218 - Signed Binary Proxy Execution T1222 - File and Directory Permissions Modification T1418 T1422 T1426 T1430 T1437 T1454 - Malicious SMS Message T1476 - Deliver Malicious App via Other Means T1489 T1490 - Inhibit System Recovery T1495 T1496 - Resource Hijacking T1497 - Virtualization/Sandbox Evasion T1497.003 T1498 - Network Denial of Service T1503 T1505 T1505.003 - Web Shell T1509 T1518 - Software Discovery T1530 T1533 T1539 T1543 - Create or Modify System Process T1543.003 - Windows Service T1547 - Boot or Logon Autostart Execution T1547.001 T1548.002 - Bypass User Account Control T1552 T1553 - Subvert Trust Controls T1555 T1558 T1558.001 T1560 T1560.001 - Archive via Utility T1562.001 T1566 T1566.001 T1569 - System Services T1569.002 T1571 T1573 - Encrypted Channel T1574 T1574.001 T1574.002 - DLL Side-Loading T1583 - Acquire Infrastructure T1583.003 T1583.005 T1587 T1587.001 T1588 T1588.001 T1588.002 - Tool T1588.004 - Digital Certificates T1592.004 - Client Configurations T1596.001 - DNS/Passive DNS T1596.004 - CDNs T1614 - System Location Discovery T1614.001

Related Zero-Days 15

CVE-2013-0422 CVE-2015-2426 CVE-2016-5195 CVE-2017-0199 CVE-2018-4878 CVE-2024-8190 CVE-2024-8963 CVE-2025-24201 CVE-2025-24983 CVE-2025-24984 CVE-2025-24985 CVE-2025-24991 CVE-2025-24993 CVE-2025-26633 CVE-2025-27363

Known Names 21 entries

Ke3chang FireEye

Vixen Panda CrowdStrike

APT 15 Mandiant

GREF SecureWorks

Bronze Palace SecureWorks

Bronze Davenport SecureWorks

Bronze Idlewood SecureWorks

CTG-9246 SecureWorks

Playful Dragon FireEye

Royal APT NCC Group

Nickel Microsoft

BackdoorDiplomacy ESET

Playful Taurus Palo Alto

Metushy ?

Social Network Team ?

Nylon Typhoon Microsoft

Flea Symantec

Red Vulture PWC

PurpleHaze SentinelOne

G0004 MITRE

G0135 MITRE

Observed Target Countries 57

Based on ETDA data — countries highlighted in red

Afghanistan Albania Argentina Barbados Belgium Bhutan Bosnia and Herzegovina Brazil Bulgaria Chile China Colombia Croatia Czech Dominican Republic Ecuador Egypt El Salvador France Georgia Germany Ghana Guatemala Honduras Hungary India Indonesia Iran Italy Jamaica Kazakhstan Kuwait Libya Malaysia Mali Mexico Montenegro Namibia Nigeria Pakistan Panama Peru Poland Portugal Saudi Arabia Slovakia South Africa Sri Lanka Switzerland Syria Trinidad and Tobago Turkey UAE UK USA Uzbekistan Venezuela

Description

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted several industries, including oil, government, military, and more.

Tools Used 37

BS2005 CarbonSteal Cobalt Strike DarthPusher EarthWorm EternalBlue DoubleAgent GoldenEagle Graphican HenBox HighNoon IRAFAU Ketrican Ketrum Mimikatz MirageFox MS Exchange Tool nbtscan netcat Okrum PluginPhantom PortQry ProcDump PsList RoyalCli RoyalDNS SilkBean Sinowal SMBTouch spwebmember SpyWaller TidePool Turian Winnti XSLCmd Living off the Land EternalRocks and EternalSynergy

Operations 14

2010 Operation “Ke3chang” As the crisis in Syria escalates, FireEye research-ers have discovered a cyber espionage campaign, which we call “Ke3chang,” that falsely advertises information updates about the ongoing crisis to compromise MFA networks in Europe. We believe that the Ke3chang attackers are operating out of China and have been active since at least 2010. However, we believe specific Syria-themed attacks against MFAs (codenamed by Ke3chang as “moviestar”) began only in August 2013. The timing of the attacks precedes a G20 meeting held in Russia that focused on the crisis in Syria. https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf

2014-08 Forced to Adapt: XSLCmd Backdoor Now on OS X https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html

2015 The Lookout Threat Intelligence team has discovered four Android surveillanceware tools, which are used to target the Uyghur ethnic minority group. Our research indicates that these four interconnected malware tools are elements of much larger mAPT (mobile advanced persistent threat) campaigns that have been active for years. Although there is evidence that the campaigns have been active since at least 2013, Lookout researchers have been monitoring the surveillanceware families — SilkBean, DoubleAgent, CarbonSteal and GoldenEagle — as far back as 2015. https://www.lookout.com/documents/threat-reports/us/lookout-uyghur-malware-tr-us.pdf

2016-05 Little has been published on the threat actors responsible for Operation Ke3chang since the report was released more than two years ago. However, Unit 42 has recently discovered the actors have continued to evolve their custom malware arsenal. We’ve discovered a new malware family we’ve named TidePool. It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide. This targeting is also consistent with previous attacker TTPs; Ke3chang historically targeted the Ministry of Affairs, and also conducted several prior campaigns against India. https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/

2017-05 Attack on a company that provides a range of services to UK Government A number of sensitive documents were stolen by the attackers during the incident and we believe APT15 was targeting information related to UK government departments and military technology. During our analysis of the compromise, we identified new backdoors that now appear to be part of APT15’s toolset. The backdoor BS2005 – which has traditionally been used by the group – now appears alongside the additional backdoors RoyalCli and RoyalDNS. https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/

2017 BackdoorDiplomacy: Upgrading from Quarian to Turian https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/

2018-06 Operation “MirageFox” The malware involved in this recent campaign, MirageFox, looks to be an upgraded version of a tool, a RAT believed to originate in 2012, known as Mirage. https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/

2019-03 The group continues to be active in 2019 – in March 2019, we detected a new Ketrican sample that has evolved from the 2018 Ketrican backdoor. It attacked the same targets as the backdoor from 2018. https://www.welivesecurity.com/2019/07/18/okrum-ke3chang-targets-diplomatic-missions/

2019-09 NICKEL targeting government organizations across Latin America and Europe https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/

2020-05 In mid May, we identified three recently uploaded samples from VirusTotal that share code with older APT15 implants. We named this new family of samples, “Ketrum”, due to the merger of features in the documented backdoor families “Ketrican” and “Okrum”. https://www.intezer.com/blog/research/the-evolution-of-apt15s-codebase-2020/

2021-08 BackdoorDiplomacy Wields New Tools in Fresh Middle East Campaign https://www.bitdefender.com/blog/labs/backdoor-diplomacy-wields-new-tools-in-fresh-middle-east-campaign/

2022-04 Chinese Playful Taurus Activity in Iran https://unit42.paloaltonetworks.com/playful-taurus/

2022 Late Graphican: Flea Uses New Backdoor in Attacks Targeting Foreign Ministries https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/flea-backdoor-microsoft-graph-apt15

2024-10 Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/

Reports & References 1

https://github.com/nccgroup/Royal_APT

ETDA Profile

Ke3chang, Vixen Panda, APT 15, GREF, Playful Dragon

Origin

China

First Seen 2010

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0004/ https://attack.mitre.org/groups/G0135/

View on ETDA APT Groups ↗