ChinaAssessedChina-basedEspionageActive 2010 – 2023APT15
Also known asVixen Panda · Ke3chang · Mirage · Nylon Typhoon · Nickel · Playful Taurus · Playful Dragon · GREF · Royal APT · Bronze Palace · Bronze Davenport · Bronze Idlewood · CTG-9246 · Flea · Red Vulture
Summary
Long-running Chinese state-sponsored actor active since 2010, tracked under multiple names across vendors. BSI (April 2026) named APT15 as actively targeting Germany in its 'Active APT groups' advisory. The group operates its own relay network of compromised routers and VPN servers for C2, making detection difficult. Historical targeting includes European foreign ministries, Central/South American government agencies, and Uyghur-focused surveillance. Uses custom tooling including MirageFox, Ketrican, and RoyalDNS, with long dwell times via LOLBins and living-off-the-land techniques.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Attributed to actors operating out of China
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| PurpleHaze cluster (loosely associated)ASSESSED | 2024-07 – 2025-03 | South Asia, EU | Government, Media, Technology | SentinelLABS 2025 — clusters attributed China-nexus with high confidence; APT15/UNC5174 overlap assessed only as a LOOSE association, not identity |
| Listed by BSI as active against German or European targets (two-year window to Apr 2026; no dated intrusion)ASSESSED | 2024-04 – 2026-04 | Germany, Europe | Government | BSI 'Active APT groups in Germany' list (2026-04-14) — active against German/European targets within the preceding two years |
| European organisations — new Ketrican variant | 2022-10 – 2023-03 | Europe | Government | ESET (2023-05-09) |
| Operation Ke3chang | 2010 – 2013 | EU | Diplomatic, Government | FireEye (2013) via Security Affairs; MITRE ATT&CK G0004 — European foreign ministries ahead of the G20 St Petersburg summit. MITRE's Americas/oil/military/NGO scope is group-level (incl. NICKEL 2021), not this operation |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Resource Development1 | T1583.005Botnet |
|---|---|
| Initial Access2 | T1566.001Spearphishing AttachmentT1133External Remote Services |
| Persistence2 | T1053Scheduled Task/JobT1547.001Registry Run Keys / Startup Folder |
| Stealth1 | T1574.001DLL |
| Credential Access1 | T1003OS Credential Dumping |
| Command and Control3 | T1090ProxyT1071.001Web ProtocolsT1105Ingress Tool Transfer |
Malware and tools 7
| Name | Description | Platform |
|---|---|---|
| MirageFox | Backdoor | Windows |
| Ketrican | Backdoor | Windows |
| RoyalDNS | DNS Backdoor | Windows |
| BS2005 | Backdoor | Windows |
| RoyalCli | Backdoor | Windows |
| Okrum | Backdoor | Windows |
| GoReShell | Backdoor (Go, reverse_ssh) | Windows |
Infrastructure patterns
- Own relay network of compromised routers and VPN servers (BSI, 2026)
- Operational relay box (ORB) network fronting C2 — PurpleHaze cluster, loosely associated (SentinelLABS 2025)
Reporting and advisories 5
- BSI
Active APT Groups in Germany (April 2026) - MITRE ATT&CK
G0004 — Ke3chang - Microsoft
MSTIC: NICKEL Targeting Government Orgs in Latin America and Europe - SentinelLABS
Follow the Smoke — China-nexus actors; PurpleHaze and ShadowPad clusters (Jul 2024 – Mar 2025) - ESET
APT Activity Report Q4 2022–Q1 2023 — new Ketrican variant against European organisations