Trusted Design

Ke3chang

アクターID: G0004

· MITRE Pageへのリンク

脅威アクターの詳細

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

脅威アクターの別名・別称

Ke3chang
APT15
Mirage
Vixen Panda
GREF
Playful Dragon
RoyalAPT
NICKEL
Nylon Typhoon

利用した攻撃手法

• T1560.001 - Archive via Utility
• T1557 - Adversary-in-the-Middle
• T1596.003 - Digital Certificates
• T1574.007 - Path Interception by PATH Environment Variable
• T1123 - Audio Capture
• T1584.008 - Network Devices
• T1195.001 - Compromise Software Dependencies and Development Tools
• T1218.013 - Mavinject
• T1178 - SID-History Injection
• T1606.002 - SAML Tokens
• T1587.001 - Malware
• T1592.001 - Hardware
• T1176.001 - Browser Extensions
• T1542.005 - TFTP Boot
• T1487 - Disk Structure Wipe
• T1027.008 - Stripped Payloads
• T1003.007 - Proc Filesystem
• T1120 - Peripheral Device Discovery
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1140 - Deobfuscate/Decode Files or Information
• T1032 - Standard Cryptographic Protocol
• T1550 - Use Alternate Authentication Material
• T1546.005 - Trap
• T1590.006 - Network Security Appliances
• T1055.013 - Process Doppelgänging
• T1198 - SIP and Trust Provider Hijacking
• T1090 - Proxy
• T1685.005 - Clear Windows Event Logs
• T1219.001 - IDE Tunneling
• T1055.004 - Asynchronous Procedure Call
• T1583.006 - Web Services
• T1087.004 - Cloud Account
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1157 - Dylib Hijacking
• T1059.011 - Lua
• T1204.003 - Malicious Image
• T1102.002 - Bidirectional Communication
• T1591.004 - Identify Roles
• T1556.005 - Reversible Encryption
• T1134 - Access Token Manipulation
• T1547.013 - XDG Autostart Entries
• T1548.006 - TCC Manipulation
• T1027.007 - Dynamic API Resolution
• T1021.001 - Remote Desktop Protocol

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1157)
• CVE-2015-5749 (T1584.008)
• CVE-2016-1898 (T1140)
• CVE-2016-1897 (T1140)
• CVE-2015-7261 (T1140)
• CVE-2015-6036 (T1027.008)
• CVE-2015-7262 (T1157)
• CVE-2015-0932 (T1140)
• CVE-2010-3081 (T1157)
• CVE-2017-16929 (T1219.001)
• CVE-2025-31125 (T1157)
• CVE-2025-68645 (T1157)
• CVE-2013-6282 (T1219.001)
• CVE-2025-55182 (T1087.004)
• CVE-2023-1389 (T1134)
• CVE-2025-13928 (T1157)
• CVE-2025-24893 (T1157)
• CVE-2025-34026 (T1055.004)
• CVE-2025-55184 (T1087.004)
• CVE-2014-1761 (T1140)
• CVE-2015-1641 (T1219.001)
• CVE-2014-4114 (T1027.007)
• CVE-2015-5119 (T1219.001)
• CVE-2015-5122 (T1134)
• CVE-2015-1427 (T1027.008)
• CVE-2015-1770 (T1027.007)
• CVE-2012-1856 (T1027.007)
• CVE-2015-2545 (T1027.007)
• CVE-2015-2546 (T1157)
• CVE-2014-6332 (T1027.007)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1157)
• CVE-2015-7645 (T1140)
• CVE-2017-0199 (T1027.007)
• CVE-2017-12149 (T1027.008)
• CVE-2015-3043 (T1134)
• CVE-2015-3090 (T1219.001)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1219.001)
• CVE-2012-0158 (T1027.007)
• CVE-2015-2502 (T1027.007)
• CVE-2014-6271 (T1591.004)
• CVE-2013-2094 (T1157)
• CVE-2014-4113 (T1027.007)
• CVE-2015-8562 (T1027.008)
• CVE-2015-7808 (T1157)
• CVE-2012-1889 (T1027.008)
• CVE-2016-1990 (T1157)
• CVE-2016-1991 (T1219.001)
• CVE-2016-1010 (T1219.001)
• CVE-2016-0984 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1219.001)
• CVE-2015-1701 (T1027.007)
• CVE-2015-0313 (T1219.001)
• CVE-2015-0359 (T1134)
• CVE-2014-0329 (T1219.001)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1157)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2015-7755 (T1027.008)
• CVE-2012-4969 (T1027.007)
• CVE-2016-1287 (T1055.004)
• CVE-2015-6585 (T1027.008)
• CVE-2015-6022 (T1219.001)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1590.006)
• CVE-2016-1562 (T1027.008)
• CVE-2016-2342 (T1055.004)
• CVE-2016-2343 (T1027.008)
• CVE-2017-0263 (T1157)
• CVE-2016-6532 (T1546.005)
• CVE-2016-9494 (T1140)
• CVE-2016-9496 (T1157)
• CVE-2016-9495 (T1584.008)
• CVE-2017-3212 (T1027.008)
• CVE-2025-61882 (T1584.008)
• CVE-2015-0311 (T1219.001)
• CVE-2012-3213 (T1219.001)
• CVE-2012-4792 (T1547.013)
• CVE-2012-1258 (T1157)
• CVE-2015-0336 (T1219.001)
• CVE-2014-3153 (T1157)
• CVE-2014-4322 (T1157)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2014-8361 (T1556.005)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2551 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1219.001)
• CVE-2012-4681 (T1157)
• CVE-2014-1776 (T1157)
• CVE-2012-1876 (T1219.001)
• CVE-2015-0071 (T1219.001)
• CVE-2015-1761 (T1157)
• CVE-2014-8440 (T1134)
• CVE-2013-3660 (T1157)
• CVE-2010-0806 (T1547.013)
• CVE-2014-4148 (T1027.007)
• CVE-2011-3402 (T1102.002)
• CVE-2010-2883 (T1591.004)
• CVE-2014-7247 (T1219.001)
• CVE-2013-2678 (T1219.001)
• CVE-2010-0738 (T1157)
• CVE-2015-2426 (T1219.001)
• CVE-2008-1436 (T1027.007)
• CVE-2010-0232 (T1157)
• CVE-2010-4398 (T1102.002)
• CVE-2014-3393 (T1055.004)
• CVE-2012-6422 (T1157)
• CVE-2013-2595 (T1157)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1157)
• CVE-2011-1255 (T1548.006)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1219.001)
• CVE-2016-0189 (T1219.001)
• CVE-2017-7255 (T1134)
• CVE-2017-0143 (T1027.007)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1157)
• CVE-2013-2465 (T1219.001)
• CVE-2013-7331 (T1027.007)
• CVE-2016-4117 (T1219.001)
• CVE-2015-0057 (T1027.007)
• CVE-2015-2360 (T1027.007)
• CVE-2015-3456 (T1157)
• CVE-2010-1553 (T1027.008)
• CVE-2016-1019 (T1157)
• CVE-2015-6034 (T1157)
• CVE-2017-0261 (T1134)
• CVE-2017-0262 (T1134)
• CVE-2013-3906 (T1059.011)
• CVE-2014-6352 (T1027.007)
• CVE-2015-0016 (T1157)
• CVE-2010-3333 (T1219.001)
• CVE-2014-0322 (T1027.007)
• CVE-2011-3544 (T1219.001)
• CVE-2014-7911 (T1027.008)
• CVE-2015-3636 (T1157)
• CVE-2014-8439 (T1219.001)
• CVE-2010-0188 (T1591.004)
• CVE-2014-0556 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2012-2539 (T1055.004)
• CVE-2014-9163 (T1219.001)
• CVE-2012-1723 (T1219.001)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2014-6324 (T1157)
• CVE-2013-0634 (T1140)
• CVE-2012-5054 (T1027.008)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2014-2273 (T1219.001)
• CVE-2015-4902 (T1219.001)
• CVE-2009-3129 (T1219.001)
• CVE-2010-2572 (T1219.001)
• CVE-2017-8570 (T1219.001)
• CVE-2012-0611 (T1055.004)
• CVE-2015-2419 (T1219.001)
• CVE-2017-0001 (T1157)
• CVE-2025-13335 (T1027.008)
• CVE-2025-13927 (T1157)
• CVE-2025-54313 (T1027.008)
• CVE-2025-55183 (T1157)
• CVE-2025-66478 (T1219.001)
• CVE-2026-1102 (T1157)
• CVE-2012-0056 (T1157)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る