Loading threat actor…
APT15 is a long-running China-linked cyber espionage threat actor widely tracked under aliases including Ke3chang, Vixen Panda, Flea, Royal APT, Nylon Typhoon, Playful Taurus, Nickel, and Playful Dragon. The group has been active for more than two decades and is associated with Chinese state-sponsored intelligence collection. Reporting ties APT15 to operations aligned with Chinese strategic interests, including theft of intellectual property, surveillance of politically relevant communities, and intrusion activity against diplomatic, governmental, media, and other high-value organizations. APT15 has targeted government and non-government organizations across more than a dozen Latin American countries, foreign ministries in North and South America, a government finance department in the Americas, and broader victim sets in Europe and South Asia. Additional victim sectors linked to recent activity include media, manufacturing, finance, telecommunications, research, and cloud-focused environments. The group has also been reported to target Chinese ethnic populations in support of state surveillance objectives. Operationally, APT15 is associated with cyber-espionage tradecraft emphasizing stealth, persistence, and flexible access methods. Reported techniques include reconnaissance of internet-facing systems, exploitation of edge-device and VPN vulnerabilities including Fortinet SSL VPN flaws, use of malware concealed with steganographic methods, deployment of modular backdoors and reverse SSH-style tooling, use of Operational Relay Box infrastructure, and abuse of cloud infrastructure to support theft of intellectual property. The group has also been linked to malware delivery and concealment approaches such as DLL side-loading. Recent reporting connected some PurpleHaze intrusions to APT15, and linked APT15-associated activity with broader ShadowPad-related espionage operations. Open-source reporting also indicates use of tooling and automation for Linux administration, infrastructure setup, script modification, brute-force development, and management of Android device fleets for coordinated online activity. APT15 is best characterized as a Chinese state-aligned espionage actor focused on long-term intelligence collection, access development, and covert post-compromise operations against government, diplomatic, strategic industry, and information-rich targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vixen Panda is a China-nexus group targeting cloud infrastructure to steal intellectual property from European organizations.
APT15 has used steganography to hide malware inside image files, facilitating covert cyber operations.
APT15 is a China-backed threat actor known for cyber-espionage campaigns targeting government entities, foreign ministries, and high-value organizations. Recently, it has been involved in attacks against cybersecurity vendors and other sectors using malware such as ShadowPad and GOREshell.
APT15 is a Chinese cyber espionage group linked to the PurpleHaze campaign, involved in targeting global organizations for intelligence gathering.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.