File · APT15 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
APT15
- VIXEN PANDA
- Ke3Chang
- Playful Dragon
- Metushy
- Lurid
- Social Network Team
- Royal APT
- BRONZE PALACE
state sponsor · ChinaMITRE G0004 ↗
attack rose · 46 techniques across 11 tactics
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2015-2545, CVE-2022-27518
Analyst brief
misp-galaxy + mitre-attackThis threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.
Observed targets (as stated by the sources)
3 countries · 2 sectorsassessed origin · Chinaobserved targets · 3
countries · 3
- India
- United Kingdom
- Germany
sectors · 2
- Government
- Government, Administration
also stated: European Union
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique46 techniques · 11 of 15 tactics
Resource development
3 techniquesInitial access
1 techniqueExecution
3 techniquesPersistence
3 techniquesStealth
6 techniquesCredential access
5 techniquesDiscovery
12 techniquesLateral movement
1 techniqueCollection
7 techniquesCommand and control
3 techniquesExfiltration
2 techniques
select a technique
Arsenal
3 malware · 8 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs cited sources tie to APT15
none on KEV- CVE-2022-275182026-10-17
“SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.”
cited as used in a campaign · named nearby · source: attack.mitre.org ↗ · 2026-10-17
- CVE-2015-25452026-10-17
“The TidePool malware is housed in an MHTML document which exploits CVE-2015-2545.”
cited as exploiting · named nearby · source: unit42.paloaltonetworks.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hosted- 2018APT15 is alive and strong: An analysis of RoyalCli and RoyalDNSNCC Group ↗
- 2016Operation Ke3chang Resurfaces With New TidePool MalwarePalo Alto ↗
- 2015Cmstar Downloader: Lurid And Enfal's New CousinPalo Alto ↗
- 2013Operation Ke3Chang Targeted Attacks Against Ministries Of Foreign AffairsFireEye ↗
- 2012The Mirage CampaignDell Secureworks ↗
- 2011The Lurid DownloaderTrend Micro ↗
Take it with you
keyless · no signupReferences
20 sources- 1.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-ba…
- 2.arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-…
- 3.github.com/nccgroup/Royal_APT
- 4.cfr.org/interactive/cyber-operations/mirage
- 5.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs…
- 6.unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware
- 7.research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-ro…
- 8.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old…
- 9.attack.mitre.org/groups/G0004
- 10.secureworks.com/research/threat-profiles/bronze-palace
- +10 more in the JSON record
Track APT15 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.