APT15
ChinaState-sponsoredUnknown
Observation period
46
Techniques
0
Reports
- Latest observed activity
- No dated reports available
- First observed
- —
Profile
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
Relevance for Germany, Austria and Switzerland
high
Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).
Target sectors according to source
- Government
Target countries according to source European Union, India, United Kingdom, Germany
Aliases
- VIXEN PANDA
- Ke3Chang
- Playful Dragon
- Metushy
- Lurid
- Social Network Team
- Royal APT
- BRONZE PALACE
- BRONZE DAVENPORT
- BRONZE IDLEWOOD
- NICKEL
- Red Vulture
- Nylon Typhoon
- Mirage
- RIVER CASTLE
MITRE ATT&CK techniques
Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.
- T1114.002
- T1105
- T1087.001
- T1033
- T1614.001
- T1087.002
- T1140
- T1558.001
- T1021.002
- T1041
- T1119
- T1083
- T1133
- T1018
- T1003.002
- T1016
- T1588.002
- T1020
- T1007
- T1543.003
- T1190
- T1036.005
- T1569.002
- T1005
- T1071.004
- T1213.002
- T1027
- T1059
- T1036.002
- T1560
- T1069.002
- T1560.001
- T1003.003
- T1057
- T1003.001
- T1587.001
- T1071.001
- T1059.003
- T1078
- T1583.005
- T1547.001
- T1049
- T1056.001
- T1003.004
- T1078.004
- T1082
Software / tooling used
ATT&CK campaigns
Linked ATT&CK campaign profiles in which this group is named as an actor.
External references
- fireeye.comfireeye.com
- arstechnica.comarstechnica.com
- github.comgithub.com
- cfr.orgcfr.org
- fireeye.comfireeye.com
- unit42.paloaltonetworks.comunit42.paloaltonetworks.com
- research.nccgroup.comresearch.nccgroup.com
- intezer.comintezer.com
- attack.mitre.orgattack.mitre.org
- secureworks.comsecureworks.com
- mandiant.commandiant.com
- pwc.compwc.com
- query.prod.cms.rt.microsoft.comquery.prod.cms.rt.microsoft.com
- bsi.bund.debsi.bund.de
- cloud.google.comcloud.google.com