Ke3chang

Ke3chang is a cyber espionage threat actor. The provided content associates Ke3chang with multiple aliases including APT15, G0004, Mirage, Nickel, Nylon Typhoon, Playful Dragon, Playful Taurus, RoyalAPT, Royal APT, Vixen Panda, Flea, Metushy, Bronze Davenport, Bronze Idlewood, Bronze Palace, Red Vulture, RedRiver, GREF, and Social Network Team. The content also includes unrelated aliases such as BlackSuit and Royal ransomware naming, but the high-confidence Ke3chang-related reporting in the content concerns espionage-style malware and ATT&CK-mapped behaviors rather than ransomware operations. The content states that Ke3chang used the RoyalDNS backdoor, which established persistence by adding a Windows service named Nwsapagent. Ke3chang malware including RoyalCli and BS2005 communicated with command-and-control servers over HTTP through Internet Explorer using the IWebBrowser2 COM interface. The actor is described as deobfuscating Base64-encoded shellcode strings prior to loading them. Reported host discovery and collection behaviors include command-line interaction to search files and directories, local network configuration discovery using ipconfig, account discovery using commands such as net localgroup administrators and net group with the /domain flag on permission groups, collection of the signed-in username, and frequent and scheduled data collection from victim networks. The content also associates Ke3chang with ATT&CK techniques including T1090.003 (Multi-hop Proxy), T1059 (Command and Scripting Interpreter), T1611 (Escape to Host), T1068 (Exploitation for Privilege Escalation), and T1543.003 (Windows Service).