Search threats, CVEs… ⌘K
← Back to all threat actors

Ke3chang

Also known as APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon
Tracked as G0004

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

How we source and review actor profiles
Motivation
nation-state
Status
Active

Activity timeline

A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.

Cataloged
IdentityAlias: APT15

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Mirage

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Vixen Panda

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: GREF

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Playful Dragon

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: RoyalAPT

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: NICKEL

Reviewed identity mapping approved on this date.

Cataloged
IdentityAlias: Nylon Typhoon

Reviewed identity mapping approved on this date.

Cataloged
IdentityTracking identifier: G0004

Reviewed identity mapping approved on this date.

Last observed
CampaignSPACEHOP Activity

SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat…

Identity and attribution

Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.

Name map

Ke3changCanonical Name
APT15Alias
GREFAlias
MirageAlias
NICKELAlias
Nylon TyphoonAlias
Playful DragonAlias
RoyalAPTAlias
Vixen PandaAlias
G0004Tracking Id

Loading CVEs, techniques, indicators, malware, victims, and activity...