APT15

APT15, also known as Vixen Panda, Nickel, Flea, KE3CHANG, Royal APT, and Playful Dragon, is a threat actor group suspected to be of Chinese origin. The group targets global sectors including trade, economic and financial, energy, and military, aligning with the interests of the Chinese government. Initial compromise typically involves well-crafted spearphishing emails sent to entities of interest. Notably, APT15 uses backdoors and infrastructure that are not exclusive to them, making attribution challenging. Additionally, the group shares resources, such as backdoors and infrastructure, with other Chinese Advanced Persistent Threat (APT) groups. Significant code similarities have been found between the Signal Plus Messenger and FlyGram samples, and the BadBazaar malware family, which Lookout attributes to the GREF cluster of APT15. In June last year, the Backdoor.Graphican was used by APT15 against foreign affairs ministries in the Americas. While some sources associate this toolset with APT15, Sekoia.io analysts' delineation of APT15 and APT25 leads us to associate both backdoors to Ke3chang, consistent with ESET. In November 2022, APT15 reportedly targeted the Uyghur community in China mainland and abroad, including in Turkey and Afghanistan, leveraging the BadBazaar malware disguised as Android mobile applications and the MOONSHINE app-based Android surveillance tooling. Despite several vendors attributing BadBazaar to APT15, ESET has not been able to conclusively establish this link. There is also disagreement among researchers about whether the GREF group is associated with APT15, due to insufficient evidence supporting this connection.