Ke3chang

Ke3chang, also known as APT15, Mirage, Vixen Panda GREF, and Playful Dragon, is a prominent threat actor that has been active since at least 2010. According to the European Union Agency for Cybersecurity (ENISA), this group has consistently targeted energy, government, and military sectors. Ke3chang is linked to various arms of China’s People’s Liberation Army or government, along with other groups such as APT27, APT30, APT31, GALLIUM, and Mustang Panda. Notably, between March 2022 and early 2023, Ke3chang targeted a government finance department in the Americas. Ke3chang's activities have evolved over time, with recent developments including the creation of Graphican's backdoor, an evolution of its signature Ketrican malware. This toolset, while associated with APT15 by Symantec, is linked to Ke3chang by Sekoia.io analysts and ESET, indicating a possible overlap in the operations of these threat actors. Other threat actors have also demonstrated similar patterns of targeting financial institutions and organizations financing infrastructure projects, such as Tropic Trooper targeting Taiwanese financial institutions, Witchetty targeting an African stock exchange, and Gallium targeting an organization financing urban infrastructure development projects in Nepal. The group's tactics, techniques, and procedures (TTPs) have been closely studied and emulated in real-world testing scenarios, underscoring their sophistication and effectiveness. For example, SE Labs replicated the TTPs of Ke3chang, among others, in their testing. Moreover, researchers at Eset attributed campaigns to a threat group tracked as Gref, which overlaps with activity also ascribed to groups including APT15, Vixen Panda, and Ke3chang. In another instance, the Chinese state-sponsored operation Flea, also known as APT15 and Ke3chang, leveraged a novel Graphican backdoor in attacks against foreign affairs ministries across the Americas between late 2022 and early 2023.