RoyalDNS
RoyalDNS is a custom DNS-based backdoor associated with the China-linked espionage group APT15, also tracked as Ke3chang, Mirage, Vixen Panda, GREF, Playful Dragon, Nickel, and Flea. It was identified by NCC Group during investigation of a May 2017 compromise of a company providing services to the UK Government, where APT15 stole sensitive documents assessed to relate to UK government departments and military technology. RoyalDNS was deployed after the actor regained access via a corporate VPN using a stolen VPN certificate extracted from a compromised host.
RoyalDNS establishes persistence on Windows systems by creating a service named "Nwsapagent." Its command-and-control channel uses DNS, specifically TXT records, and reported C2 communications used the domain andspurs[.]com. The malware is described as one of several APT15 backdoors alongside RoyalCli, BS2005, Okrum, Ketrum, and later Graphican. In the cited intrusion, RoyalDNS represented APT15’s shift to a DNS-based backdoor after earlier tooling in the same campaign used HTTP communications via Internet Explorer COM objects.
High-confidence associated context indicates APT15 commonly targets government, diplomatic, and military-related entities and uses credential theft, keylogging, lateral movement, and living-off-the-land techniques during operations. For RoyalDNS specifically, the directly stated behaviors are its Windows service-based persistence through "Nwsapagent" and DNS TXT record-based C2. A known network IOC directly linked to RoyalDNS is andspurs[.]com.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Persistence
1 technique
Persistence
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Privilege Escalation
1 technique
Privilege Escalation
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
RoyalDNS is a backdoor malware used by APT15, leveraging DNS for command and control communications.
Custom backdoor used by APT15 as part of its malware arsenal for covert access.
Custom APT15 implant/backdoor referenced as part of the group’s historical tooling.
DNS-based APT15 backdoor that performs C2 over DNS TXT records (observed domain: andspurs[.]com). Persistence achieved via a service named 'Nwsapagent'.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.