Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.1234
- Mandiant Operation Ke3chang November 2014
- NCC Group APT15 Alive and Strong
- APT15 Intezer June 2018
- Microsoft NICKEL December 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1114.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1558.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1020 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1213.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1007 | System Service Discovery | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1020 | Automated Exfiltration | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027 | Obfuscated Files or Information | — |
| T1033 | System Owner/User Discovery | — |
| T1036.002 | Right-to-Left Override | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1049 | System Network Connections Discovery | — |
| T1056.001 | Keylogging | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.003 | Windows Command Shell | — |
| T1069.002 | Domain Groups | — |
| T1071.001 | Web Protocols | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1087.002 | Domain Account | — |
| T1105 | Ingress Tool Transfer | — |
| T1114.002 | Remote Email Collection | — |
| T1119 | Automated Collection | — |
| T1133 | External Remote Services | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1213.002 | Sharepoint | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1558.001 | Golden Ticket | — |
| T1560 | Archive Collected Data | — |
| T1560.001 | Archive via Utility | — |
| T1569.002 | Service Execution | — |
| T1583.005 | Botnet | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1614.001 | System Language Discovery | — |
Aliases
APT15 · GREF · Ke3chang · Mirage · NICKEL · Nylon Typhoon · Playful Dragon · RoyalAPT · Vixen Panda
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.