APT15

Threat Actor updated 5 months ago (2024-05-04T17:57:34.445Z)

Download STIX

Preview STIX

APT15, also known as Vixen Panda, Nickel, Flea, KE3CHANG, Royal APT, and Playful Dragon, is a threat actor group suspected to be of Chinese origin. The group targets global sectors including trade, economic and financial, energy, and military, aligning with the interests of the Chinese government. Initial compromise typically involves well-crafted spearphishing emails sent to entities of interest. Notably, APT15 uses backdoors and infrastructure that are not exclusive to them, making attribution challenging. Additionally, the group shares resources, such as backdoors and infrastructure, with other Chinese Advanced Persistent Threat (APT) groups. Significant code similarities have been found between the Signal Plus Messenger and FlyGram samples, and the BadBazaar malware family, which Lookout attributes to the GREF cluster of APT15. In June last year, the Backdoor.Graphican was used by APT15 against foreign affairs ministries in the Americas. While some sources associate this toolset with APT15, Sekoia.io analysts' delineation of APT15 and APT25 leads us to associate both backdoors to Ke3chang, consistent with ESET. In November 2022, APT15 reportedly targeted the Uyghur community in China mainland and abroad, including in Turkey and Afghanistan, leveraging the BadBazaar malware disguised as Android mobile applications and the MOONSHINE app-based Android surveillance tooling. Despite several vendors attributing BadBazaar to APT15, ESET has not been able to conclusively establish this link. There is also disagreement among researchers about whether the GREF group is associated with APT15, due to insufficient evidence supporting this connection.

Description last updated: 2024-05-02T13:16:27.546Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
NICKEL is a possible alias for APT15. Nickel is a notable threat actor in the cybersecurity landscape, associated with several nation-state affiliated groups such as FIN6, APT15, BackdoorDiplomacy, Vixen Panda, and Emissary Panda. This group has been actively targeting critical Active Directory assets, notably the NTDS.dit file, the KRB	3
Vixen Panda is a possible alias for APT15. Vixen Panda, also known as APT15, Flea, KE3CHANG, Nickel, Playful Dragon, Royal APT, and BackdoorDiplomacy, among other names, is a significant threat actor believed to be sponsored by the Chinese government. The group has been operational since at least 2004, targeting government entities, diplomat	2
GREF is a possible alias for APT15. GREF, a China-aligned Advanced Persistent Threat (APT) group, has been identified as the orchestrator of two active Android malware campaigns. The campaigns have been distributing a malicious software called BadBazaar via two applications, Signal Plus Messenger and FlyGram, through the Google Play s	2
Ke3chang is a possible alias for APT15. Ke3chang, also known as APT15, Mirage, Vixen Panda GREF, and Playful Dragon, is a prominent threat actor that has been active since at least 2010. According to the European Union Agency for Cybersecurity (ENISA), this group has consistently targeted energy, government, and military sectors. Ke3chang	2
Playful Dragon is a possible alias for APT15. Playful Dragon, also known as APT15, Ke3chang, Mirage, Vixen Panda, GREF, Flea, Nickel, and Royal APT, is a notable threat actor in the cybersecurity sphere. This group has been identified by cybersecurity professionals as being behind numerous malicious activities with a history of targeting govern	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Malware

Backdoor

Apt

Microsoft

Espionage

China

Signal

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The graphican Malware is associated with APT15. Graphican is a novel malware developed by the Chinese threat actor group known as Flea, APT15, or Nickel. The malware, an evolution of the group's custom backdoor Ketrican, has been used in a series of cyber-attacks against foreign affairs ministries across Central and South America between late 202	Unspecified	2
The Ketrican Malware is associated with APT15. Ketrican is a type of malware, or malicious software, that was developed to exploit and damage computer systems. It's associated with the Ke3chang group and is known for its ability to infiltrate systems through suspicious downloads, emails, or websites. Once inside a system, Ketrican can steal pers	Unspecified	2
The Badbazaar Malware is associated with APT15. BadBazaar is a malicious software, or malware, employed by EvilBamboo, a threat actor group. This malware is part of three Android spyware families developed by the group, including BADBAZAAR, BADSIGNAL, and BADSOLAR. These are custom-built to target adversaries of the Chinese Communist Party (CCP).	Unspecified	2
The Signal Plus Messenger Malware is associated with APT15. Signal Plus Messenger and FlyGram are malware variants of a sophisticated espionage tool named BadBazaar, believed to be orchestrated by a China-linked threat actor known as Gref. These malicious applications were distributed through the Google Play store, Samsung Galaxy Store, and specific websites	Unspecified	2

Associated Vulnerabilities

To see the evidence that has resulted in these vulnerability associations, create a free account

Alias Description	Association Type	Votes
The CVE-2020-1472 Vulnerability is associated with APT15. CVE-2020-1472, also known as the Zerologon vulnerability, is a critical-severity flaw in Microsoft's Netlogon Remote Protocol. The vulnerability allows attackers to gain administrative access to a Windows domain controller without any authentication, effectively giving them control over a network. T	Unspecified	2

Source Document References

Information about the APT15 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
DARKReading	6 months ago	Microsoft Graph API Emerges as a Top Attacker Tool to Plot Data Theft
CERT-EU	a year ago	Multiple Chinese APTs are attacking European targets, EU cyber agency warns \| #ukscams \| #datingscams \| #european \| #datingscams \| #love \| #relationships \| #scams \| #pof \| #match.com \| #dating \| National Cyber Security Consulting
CERT-EU	a year ago	My Tea's not cold : an overview of China's cyber threat – Global Security Mag Online
CERT-EU	a year ago	BadBazaar: Chinese Spyware Shams Signal, Telegram Apps
DARKReading	a year ago	Chinese Group Spreads Android Spyware Via Trojan Signal, Telegram Apps
CERT-EU	a year ago	‘Earth Estries’ Cyberespionage Group Targets Government, Tech Sectors
CERT-EU	a year ago	BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
CERT-EU	a year ago	Industrial Organizations in Eastern Europe Targeted by Chinese Cyberspies
CERT-EU	a year ago	Novel Graphican backdoor leveraged in Chinese APT attacks against foreign ministries
CERT-EU	a year ago	Cyber security week in review: June 23, 2023
CERT-EU	a year ago	China-Linked APT15 Targets Foreign Ministries With ‘Graphican’ Backdoor
CERT-EU	a year ago	China-sponsored APT group targets government ministries in the Americas
CERT-EU	a year ago	Graphican: Flea uses new backdoor in attacks targeting Foreign Ministries – Cyber Security Review
DARKReading	a year ago	20-Year-Old Chinese APT15 Finds New Life in Foreign Ministry Attacks
CERT-EU	a year ago	Chinese Hackers APT15 Use New Backdoor Malware to Target American Ministries
CERT-EU	a year ago	China-Linked 'Flea' Hacking Group Tied to Cyberattacks on Foreign Ministries \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #hacker \| National Cyber Security Consulting
MITRE	2 years ago	NICKEL targeting government organizations across Latin America and Europe - Microsoft Security Blog
MITRE	2 years ago	MirageFox: APT15 Resurfaces With New Tools Based On Old Ones - Intezer
MITRE	2 years ago	APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS
MITRE	2 years ago	Advanced Persistent Threats (APTs) \| Threat Actors & Groups