Ke3chang
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Ke3changOur name
- NICKELMicrosoft
- Nylon TyphoonMicrosoft
- APT15MITRE ATT&CK
- GREFMITRE ATT&CK
- MirageMITRE ATT&CK
- Playful DragonMITRE ATT&CK
- RoyalAPTMITRE ATT&CK
- Vixen PandaMITRE ATT&CK
Targets
Sectors: Government, Defence, NGOs and think tanks, Diplomatic
Regions: Europe, Latin America, North America
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.002Security Account Manager
- T1003.003NTDS
- T1003.004LSA Secrets
- T1005Data from Local System
- T1007System Service Discovery
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1020Automated Exfiltration
- T1021.002SMB/Windows Admin Shares
- T1027Obfuscated Files or Information
- T1033System Owner/User Discovery
- T1036.002Right-to-Left Override
- T1036.005Match Legitimate Resource Name or Location
- T1041Exfiltration Over C2 Channel
- T1049System Network Connections Discovery
- T1056.001Keylogging
- T1057Process Discovery
- T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1069.002Domain Groups
- T1071.001Web Protocols
- T1071.004DNS
- T1078Valid Accounts
- T1078.004Cloud Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1087.002Domain Account
- T1105Ingress Tool Transfer
- T1114.002Remote Email Collection
- T1119Automated Collection
- T1133External Remote Services
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1213.002Sharepoint
- T1543.003Windows Service
- T1547.001Registry Run Keys / Startup Folder
- T1558.001Golden Ticket
- T1560Archive Collected Data
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.