Loading malware…
Okrum is a Windows backdoor associated with the Ke3chang threat group, also tracked as APT15, Vixen Panda, and Nickel. It has been used in cyberespionage operations against diplomatic organizations, particularly missions in Europe and Latin America, and was observed targeting diplomatic entities in countries including Slovakia, Belgium, Chile, Guatemala, and Brazil. Activity linked to Okrum was first detected in late 2016 and fits Ke3chang’s long-running pattern of maintaining persistent access for information theft and manual operator-driven post-compromise activity.
Okrum is deployed as a DLL backdoor loaded by earlier-stage components. Its loader can decrypt the embedded backdoor either from its own body or from code concealed inside a legitimate PNG image, using custom XOR or RC4-based routines. The malware uses encrypted and encoded command-and-control communications, including AES-encrypted traffic and Base64-encoded data exchange. It supports core remote-access functionality such as executing shell commands, uploading and downloading files, and executing additional payloads. Operators have also used external tooling alongside Okrum, including keylogging and credential-access utilities, reflecting a broader intrusion workflow centered on hands-on-keyboard espionage.
The malware includes host reconnaissance capabilities such as collecting the current username, local date and time, and network configuration details including IP, DNS, and proxy information. It can exfiltrate data over its existing command-and-control channel and has been observed storing command output and logs in hidden files prior to upload, then deleting those files after successful transmission. Okrum also employs persistence mechanisms on Windows, including creation of scheduled tasks and Startup-folder shortcut persistence through malicious .lnk files.
Okrum has been characterized by frequent implementation changes and multiple loader variants, alongside defense-evasion measures such as payload concealment in image files, anti-emulation, and anti-sandbox checks. It is closely related to other Ke3chang tooling including Ketrican and RoyalDNS, and later malware evolution blended features from Okrum with Ketrican-derived code.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The three samples we discovered seem to be a mix of the Ketrican and Okrum backdoors documented by researchers at ESET in 2019.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The installer component tries to achieve persistence by creating a scheduled task.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Okrum’s backdoor uses cmd.exe to execute arbitrary commands.
Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The installer component tries to achieve persistence by creating a scheduled task.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The installer component tries to achieve persistence by creating a scheduled task.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
Okrum's payload is encrypted and embedded within the Stage 1 loader, or within a legitimate PNG file.
Okrum establishes persistence by adding a new service NtmsSvc with the display name Removable Storage in an attempt to masquerade as a legitimate Removable Storage Manager.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
The Stage 1 loader performs several checks on the victim's machine to avoid being emulated or executed in a sandbox.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
The communication with the C&C server is hidden in the Cookie and Set-Cookie headers of HTTP requests.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
65 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Okrum is a backdoor malware used by APT15, notable for using steganography to conceal payloads within PNG images.
Windows malware used by APT15 for malicious access and espionage operations.
Custom APT15 implant/backdoor referenced as part of the group’s historical tooling.
Backdoor that can collect the victim username.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.