Threat Actor Profile
High
APT
Description
Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)
Confidence Score
Known Aliases
Ke3chang
APT15
Mirage
Vixen Panda
GREF
Playful Dragon
RoyalAPT
NICKEL
Nylon Typhoon
Tags
mitre-attack
stix-2.1
intrusion-set
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (46)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Ke3chang',
'APT15',
'Mirage',
'Vixen Panda',
'GREF',
'Playful Dragon',
'RoyalAPT',
'NICKEL',
'Nylon Typhoon'],
'created': '2017-05-31T21:31:47.177Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat '
'group attributed to actors operating out of China. '
'[Ke3chang](https://attack.mitre.org/groups/G0004) has '
'targeted oil, government, diplomatic, military, and NGOs in '
'Central and South America, the Caribbean, Europe, and North '
'America since at least 2010.(Citation: Mandiant Operation '
'Ke3chang November 2014)(Citation: NCC Group APT15 Alive and '
'Strong)(Citation: APT15 Intezer June 2018)(Citation: '
'Microsoft NICKEL December 2021)',
'external_references': [{'external_id': 'G0004',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G0004'},
{'description': '(Citation: APT15 Intezer June 2018)',
'source_name': 'RoyalAPT'},
{'description': '(Citation: Microsoft NICKEL December '
'2021)',
'source_name': 'NICKEL'},
{'description': '(Citation: Microsoft Threat Actor '
'Naming July 2023)',
'source_name': 'Nylon Typhoon'},
{'description': '(Citation: NCC Group APT15 Alive and '
'Strong)',
'source_name': 'APT15'},
{'description': '(Citation: NCC Group APT15 Alive and '
'Strong)',
'source_name': 'Mirage'},
{'description': '(Citation: NCC Group APT15 Alive and '
'Strong)',
'source_name': 'GREF'},
{'description': '(Citation: NCC Group APT15 Alive and '
'Strong)(Citation: APT15 Intezer June '
'2018)',
'source_name': 'Vixen Panda'},
{'description': '(Citation: NCC Group APT15 Alive and '
'Strong)(Citation: APT15 Intezer June '
'2018)',
'source_name': 'Playful Dragon'},
{'description': '(Citation: Villeneuve et al 2014) '
'(Citation: NCC Group APT15 Alive and '
'Strong) (Citation: APT15 Intezer '
'June 2018)',
'source_name': 'Ke3chang'},
{'description': 'Microsoft . (2023, July 12). How '
'Microsoft names threat actors. '
'Retrieved November 17, 2023.',
'source_name': 'Microsoft Threat Actor Naming July '
'2023',
'url': 'https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide'},
{'description': 'MSTIC. (2021, December 6). NICKEL '
'targeting government organizations '
'across Latin America and Europe. '
'Retrieved March 18, 2022.',
'source_name': 'Microsoft NICKEL December 2021',
'url': 'https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe'},
{'description': 'Rosenberg, J. (2018, June 14). '
'MirageFox: APT15 Resurfaces With New '
'Tools Based On Old Ones. Retrieved '
'September 21, 2018.',
'source_name': 'APT15 Intezer June 2018',
'url': 'https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/'},
{'description': 'Smallridge, R. (2018, March 10). '
'APT15 is alive and strong: An '
'analysis of RoyalCli and RoyalDNS. '
'Retrieved April 4, 2018.',
'source_name': 'NCC Group APT15 Alive and Strong',
'url': 'https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/'},
{'description': 'Villeneuve, N., Bennett, J. T., '
'Moran, N., Haq, T., Scott, M., & '
'Geers, K. (2014). OPERATION '
'“KE3CHANG”: Targeted Attacks Against '
'Ministries of Foreign Affairs. '
'Retrieved November 12, 2014.',
'source_name': 'Mandiant Operation Ke3chang November '
'2014',
'url': 'https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs'},
{'description': 'Villeneuve, N., Bennett, J. T., '
'Moran, N., Haq, T., Scott, M., & '
'Geers, K. (2014). OPERATION '
'“KE3CHANG”: Targeted Attacks Against '
'Ministries of Foreign Affairs. '
'Retrieved November 12, 2014.',
'source_name': 'Villeneuve et al 2014',
'url': 'https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf'}],
'id': 'intrusion-set--6713ab67-e25b-49cc-808d-2b36d4fbc35c',
'modified': '2025-04-04T17:08:55.617Z',
'name': 'Ke3chang',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.2.0',
'x_mitre_contributors': ['Pooja Natarajan, NEC Corporation India',
'Manikantan Srinivasan, NEC Corporation India',
'Hiroki Nagahama, NEC Corporation'],
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '3.1'}