APT15

Threat Actor Profile Updated 24 days ago
Download STIX
Preview STIX
APT15, also known as Vixen Panda, Nickel, Flea, KE3CHANG, Royal APT, and Playful Dragon, is a threat actor group suspected to be of Chinese origin. The group targets global sectors including trade, economic and financial, energy, and military, aligning with the interests of the Chinese government. Initial compromise typically involves well-crafted spearphishing emails sent to entities of interest. Notably, APT15 uses backdoors and infrastructure that are not exclusive to them, making attribution challenging. Additionally, the group shares resources, such as backdoors and infrastructure, with other Chinese Advanced Persistent Threat (APT) groups. Significant code similarities have been found between the Signal Plus Messenger and FlyGram samples, and the BadBazaar malware family, which Lookout attributes to the GREF cluster of APT15. In June last year, the Backdoor.Graphican was used by APT15 against foreign affairs ministries in the Americas. While some sources associate this toolset with APT15, Sekoia.io analysts' delineation of APT15 and APT25 leads us to associate both backdoors to Ke3chang, consistent with ESET. In November 2022, APT15 reportedly targeted the Uyghur community in China mainland and abroad, including in Turkey and Afghanistan, leveraging the BadBazaar malware disguised as Android mobile applications and the MOONSHINE app-based Android surveillance tooling. Despite several vendors attributing BadBazaar to APT15, ESET has not been able to conclusively establish this link. There is also disagreement among researchers about whether the GREF group is associated with APT15, due to insufficient evidence supporting this connection.
What's your take? (Question 1 of 5)
0882ada3-e7e4-4ea8-8f5f-1bb50fa8b957 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
NICKEL
3
Nickel is a notable threat actor, or malicious entity, that has been involved in significant cyber operations. Notably, Nickel targeted government organizations across Latin America and Europe, alongside other nation-state affiliated threat actors such as FIN6 and Emissary Panda. These groups focuse
Vixen Panda
2
Vixen Panda, also known as APT15, Flea, KE3CHANG, Nickel, Playful Dragon, Royal APT, and BackdoorDiplomacy, among other names, is a significant threat actor believed to be sponsored by the Chinese government. The group has been operational since at least 2004, targeting government entities, diplomat
GREF
2
GREF, a China-aligned Advanced Persistent Threat (APT) group, has been identified as the orchestrator of two active Android malware campaigns. The campaigns have been distributing a malicious software called BadBazaar via two applications, Signal Plus Messenger and FlyGram, through the Google Play s
Ke3chang
2
Ke3chang, also known as APT15, Mirage, Vixen Panda GREF, and Playful Dragon, is a prominent threat actor that has been active since at least 2010. According to the European Union Agency for Cybersecurity (ENISA), this group has consistently targeted energy, government, and military sectors. Ke3chang
Playful Dragon
2
Playful Dragon, also known as APT15, Ke3chang, Mirage, Vixen Panda, GREF, Flea, Nickel, and Royal APT, is a notable threat actor in the cybersecurity sphere. This group has been identified by cybersecurity professionals as being behind numerous malicious activities with a history of targeting govern
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Backdoor
Apt
Microsoft
Espionage
China
Signal
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
graphicanUnspecified
2
Graphican is a novel malware developed by the Chinese threat actor group known as Flea, APT15, or Nickel. The malware, an evolution of the group's custom backdoor Ketrican, has been used in a series of cyber-attacks against foreign affairs ministries across Central and South America between late 202
KetricanUnspecified
2
Ketrican is a type of malware, or malicious software, that was developed to exploit and damage computer systems. It's associated with the Ke3chang group and is known for its ability to infiltrate systems through suspicious downloads, emails, or websites. Once inside a system, Ketrican can steal pers
BadbazaarUnspecified
2
BadBazaar is a malicious software (malware) developed by EvilBamboo, a hacker group that primarily targets the Uyghur community in China and abroad, including Turkey and Afghanistan. This malware, along with two others named BADSIGNAL and BADSOLAR, is designed to exploit Android devices through dece
Signal Plus MessengerUnspecified
2
Signal Plus Messenger and FlyGram are malware variants of a sophisticated espionage tool named BadBazaar, believed to be orchestrated by a China-linked threat actor known as Gref. These malicious applications were distributed through the Google Play store, Samsung Galaxy Store, and specific websites
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
CVE-2020-1472Unspecified
2
CVE-2020-1472, also known as the ZeroLogon vulnerability, is a critical-severity privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It was patched on August 11, 2020. This vulnerability allows attackers to gain administrative access to a Windows domain controller without any authenti
Source Document References
Information about the APT15 Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS
MITRE
a year ago
MirageFox: APT15 Resurfaces With New Tools Based On Old Ones - Intezer
MITRE
a year ago
Advanced Persistent Threats (APTs) | Threat Actors & Groups
DARKReading
a year ago
20-Year-Old Chinese APT15 Finds New Life in Foreign Ministry Attacks
CERT-EU
a year ago
China-Linked APT15 Targets Foreign Ministries With ‘Graphican’ Backdoor
CERT-EU
8 months ago
My Tea's not cold : an overview of China's cyber threat – Global Security Mag Online
CERT-EU
a year ago
Chinese Hackers APT15 Use New Backdoor Malware to Target American Ministries
DARKReading
9 months ago
Chinese Group Spreads Android Spyware Via Trojan Signal, Telegram Apps
CERT-EU
9 months ago
BadBazaar: Chinese Spyware Shams Signal, Telegram Apps
CERT-EU
9 months ago
BadBazaar espionage tool targets Android users via trojanized Signal and Telegram apps
CERT-EU
a year ago
В кибератаке на МИД Словении подозревают хакеров из Китая
MITRE
a year ago
NICKEL targeting government organizations across Latin America and Europe - Microsoft Security Blog
CERT-EU
9 months ago
‘Earth Estries’ Cyberespionage Group Targets Government, Tech Sectors
CERT-EU
10 months ago
Industrial Organizations in Eastern Europe Targeted by Chinese Cyberspies
CERT-EU
a year ago
Graphican: Flea uses new backdoor in attacks targeting Foreign Ministries – Cyber Security Review
DARKReading
a month ago
Microsoft Graph API Emerges as a Top Attacker Tool to Plot Data Theft
CERT-EU
a year ago
Cyber security week in review: June 23, 2023
CERT-EU
a year ago
Novel Graphican backdoor leveraged in Chinese APT attacks against foreign ministries
CERT-EU
a year ago
China-sponsored APT group targets government ministries in the Americas
CERT-EU
a year ago
China-Linked 'Flea' Hacking Group Tied to Cyberattacks on Foreign Ministries | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker | National Cyber Security Consulting