Skip to content

Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

ATT&CK ID: G0004
Origin: China
Weather family: Typhoon
Techniques: 37
Tools: 11

Also tracked as APT15 · Mirage · Vixen Panda · GREF · Playful Dragon · RoyalAPT · NICKEL · Nylon Typhoon

Techniques

Resource Development

Acquire Infrastructure Develop Capabilities Obtain Capabilities

Initial Access

Valid Accounts External Remote Services Exploit Public-Facing Application

Execution

Command and Scripting Interpreter System Services

Persistence

Valid Accounts External Remote Services Create or Modify System Process Boot or Logon Autostart Execution

Privilege Escalation

Valid Accounts Create or Modify System Process Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Valid Accounts Deobfuscate/Decode Files or Information

Credential Access

OS Credential Dumping Input Capture Steal or Forge Kerberos Tickets

Discovery

System Service Discovery System Network Configuration Discovery Remote System Discovery System Owner/User Discovery System Network Connections Discovery Process Discovery Permission Groups Discovery System Information Discovery File and Directory Discovery Account Discovery System Location Discovery

Lateral Movement

Remote Services

Collection

Data from Local System Input Capture Email Collection Automated Collection Data from Information Repositories Archive Collected Data

Command and Control

Application Layer Protocol Ingress Tool Transfer

Exfiltration

Automated Exfiltration Exfiltration Over C2 Channel

Software

Mimikatz · MirageFox · Neoichor · Net · Okrum · Ping · Systeminfo · Tasklist · ipconfig · netstat · spwebmember

MITRE ATT&CK All threat actors