LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0004: Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

EnterpriseG0004GroupObject v3.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0004: Ke3chang describes [Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

Executive priority

G0004: Ke3chang is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0004: Ke3chang by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0004: Ke3chang appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

46 rows
DomainIDNameRelationship / procedure
EnterpriseT1114.002Remote Email CollectionSub-technique

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.[2][4]

EnterpriseT1105Ingress Tool Transfer

Ke3chang has used tools to download files to compromised machines.[4]

EnterpriseT1087.001Local AccountSub-technique

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.[1]

EnterpriseT1033System Owner/User Discovery

Ke3chang has used implants capable of collecting the signed-in username.[4]

EnterpriseT1614.001System Language DiscoverySub-technique

Ke3chang has used implants to collect the system language ID of a compromised machine.[4]

EnterpriseT1087.002Domain AccountSub-technique

Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.[4]

EnterpriseT1558.001Golden TicketSub-technique

Ke3chang has used Mimikatz to generate Kerberos golden tickets.[2]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.[1][2]

EnterpriseT1041Exfiltration Over C2 Channel

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.[1]

EnterpriseT1119Automated Collection

Ke3chang has performed frequent and scheduled data collection from victim networks.[4]

EnterpriseT1083File and Directory Discovery

Ke3chang uses command-line interaction to search files and directories.[1][4]

EnterpriseT1133External Remote Services

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.[2][4]

EnterpriseT1018Remote System Discovery

Ke3chang has used network scanning and enumeration tools, including Ping.[2]

EnterpriseT1003.002Security Account ManagerSub-technique

Ke3chang has dumped credentials, including by using gsecdump.[1][2]

EnterpriseT1016System Network Configuration Discovery

Ke3chang has performed local network configuration discovery using ipconfig.[1][2][4]

EnterpriseT1588.002ToolSub-technique

Ke3chang has obtained and used tools such as Mimikatz.[2]

EnterpriseT1020Automated Exfiltration

Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.[4]

EnterpriseT1007System Service Discovery

Ke3chang performs service discovery using net start commands.[1]

EnterpriseT1543.003Windows ServiceSub-technique

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.[2]

EnterpriseT1190Exploit Public-Facing Application

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.[4]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.[4]

EnterpriseT1569.002Service ExecutionSub-technique

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.[2]

EnterpriseT1005Data from Local System

Ke3chang gathered information and files from local directories for exfiltration.[1][4]

EnterpriseT1071.004DNSSub-technique

Ke3chang malware RoyalDNS has used DNS for C2.[2]

EnterpriseT1213.002SharepointSub-technique

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.[2]

EnterpriseT1027Obfuscated Files or Information

Ke3chang has used Base64-encoded shellcode strings.[4]

EnterpriseT1059Command and Scripting Interpreter

Malware used by Ke3chang can run commands on the command-line interface.[1][2]

EnterpriseT1036.002Right-to-Left OverrideSub-technique

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.[1]

EnterpriseT1560Archive Collected Data

The Ke3chang group has been known to compress data before exfiltration.[1]

EnterpriseT1069.002Domain GroupsSub-technique

Ke3chang performs discovery of permission groups net group /domain.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.[1][4]

EnterpriseT1003.003NTDSSub-technique

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.[4]

EnterpriseT1057Process Discovery

Ke3chang performs process discovery using tasklist commands.[1][2]

EnterpriseT1003.001LSASS MemorySub-technique

Ke3chang has dumped credentials, including by using Mimikatz.[1][2][4]

EnterpriseT1587.001MalwareSub-technique

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.[4]

EnterpriseT1071.001Web ProtocolsSub-technique

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.[2][4]

EnterpriseT1059.003Windows Command ShellSub-technique

Ke3chang has used batch scripts in its malware to install persistence mechanisms.[2]

EnterpriseT1078Valid Accounts

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.[4]

EnterpriseT1583.005BotnetSub-technique

Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.CitationORB Mandiant

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Several Ke3chang backdoors achieved persistence by adding a Run key.[2]

EnterpriseT1049System Network Connections Discovery

Ke3chang performs local network connection discovery using netstat.[1][2]

EnterpriseT1056.001KeyloggingSub-technique

Ke3chang has used keyloggers.[2][4]

EnterpriseT1003.004LSA SecretsSub-technique

Ke3chang has dumped credentials, including by using gsecdump.[1][2]

EnterpriseT1078.004Cloud AccountsSub-technique

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.[4]

EnterpriseT1082System Information Discovery

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.[1][2][4]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0097: Ping

Ping is an operating system utility commonly used to troubleshoot and verify network connections. [1]

ToolEnterprise

S0104: netstat

netstat is an operating system utility that displays active TCP connections, listening ports, and network statistics. [1]

ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
ToolEnterprise

S0057: Tasklist

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]

MalwareEnterprise

S0280: MirageFox

MirageFox is a remote access tool used against Windows systems. It appears to be an upgraded version of a tool known as Mirage, which is a RAT believed to originate in 2012. [1]

Windows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
ToolEnterprise

S0100: ipconfig

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. [1]

CampaignEnterprise

C0052: SPACEHOP Activity

SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as APT5 and Ke3chang – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.[1]

Relationship explorer

All related ATT&CK context

attributed to · CampaignC0052: SPACEHOP ActivityEnterpriseuses · TechniqueT1114.002: Remote Email CollectionEnterpriseuses · ToolS0097: PingEnterpriseuses · MalwareS0439: OkrumEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · ToolS0096: SysteminfoEnterpriseuses · ToolS0104: netstatEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1558.001: Golden TicketEnterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · ToolS0227: spwebmemberEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · ToolS0057: TasklistEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1133: External Remote ServicesEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · MalwareS0280: MirageFoxEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
3.1
Created
Modified
Raw hash
a38f68398d5cac5a...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.23.1Current bundlea38f68398d5c…
19.13.1Older bundlef3336ac68b3c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Mandiant Operation Ke3chang November 2014

    Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.

    Open source URL
  2. [2]
    NCC Group APT15 Alive and Strong

    Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.

    Open source URL
  3. [3]
    APT15 Intezer June 2018

    Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.

    Open source URL
  4. [4]
    Microsoft NICKEL December 2021

    MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.

    Open source URL
  5. [5]
    APT15

    (Citation: NCC Group APT15 Alive and Strong)

  6. [6]
    GREF

    (Citation: NCC Group APT15 Alive and Strong)

  7. [7]
    Ke3chang

    (Citation: Villeneuve et al 2014) (Citation: NCC Group APT15 Alive and Strong) (Citation: APT15 Intezer June 2018)

  8. [8]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  9. [9]
    Mirage

    (Citation: NCC Group APT15 Alive and Strong)

  10. [10]
    NICKEL

    (Citation: Microsoft NICKEL December 2021)

  11. [11]
    Nylon Typhoon

    (Citation: Microsoft Threat Actor Naming July 2023)

  12. [12]
    Playful Dragon

    (Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)

  13. [13]
    RoyalAPT

    (Citation: APT15 Intezer June 2018)

  14. [14]
    Villeneuve et al 2014

    Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.

    Open source URL
  15. [15]
    Vixen Panda

    (Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)

  16. [16]
    mitre-attackG0004
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use