APT15
Also known as VIXEN PANDA, Ke3Chang, Playful Dragon, Metushy, Lurid, Social Network Team, Royal APT, BRONZE PALACE, BRONZE DAVENPORT, BRONZE IDLEWOOD, NICKEL, G0004, Red Vulture, Nylon Typhoon, Mirage, RIVER CASTLE, GREF, RoyalAPT
0mentions, 7 days
3mentions, 30 days
Oct 25, 2026last mentioned
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
Targets: Government, European Union, India, United Kingdom, Germany
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1005 Data from Local SystemT1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1020 Automated ExfiltrationT1021.002 SMB/Windows Admin SharesT1027 Obfuscated Files or InformationT1033 System Owner/User DiscoveryT1036.002 Right-to-Left OverrideT1036.005 Match Legitimate Resource Name or LocationT1041 Exfiltration Over C2 ChannelT1049 System Network Connections DiscoveryT1056.001 KeyloggingT1057 Process DiscoveryT1059 Command and Scripting InterpreterT1059.003 Windows Command ShellT1069.002 Domain GroupsT1071.001 Web ProtocolsT1071.004 DNST1078 Valid AccountsT1078.004 Cloud AccountsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1105 Ingress Tool TransferT1114.002 Remote Email CollectionT1119 Automated CollectionT1133 External Remote ServicesT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1213.002 SharepointT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup FolderT1558.001 Golden TicketT1560 Archive Collected DataT1560.001 Archive via UtilityT1569.002 Service ExecutionT1583.005 BotnetT1587.001 MalwareT1588.002 ToolT1614.001 System Language Discovery
Recent activity
- It's Sunday. After last week's vulnerability madness, church sounds wise. 馃檹 We've put serious work into the OffSeq ecosystem. All three platforms hmastodon 路 Oct 25, 2026
- Mirage Feed: daily honeypot threat intelligencereddit 路 Oct 23, 2026
- Mirage Feed: daily honeypot threat intelligencereddit 路 Oct 23, 2026
References
- https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html
- http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/
- https://github.com/nccgroup/Royal_APT
- https://www.cfr.org/interactive/cyber-operations/mirage
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf
- https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
- https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/
- https://attack.mitre.org/groups/G0004/
- https://www.secureworks.com/research/threat-profiles/bronze-palace
- https://www.mandiant.com/resources/insights/apt-groups
- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.