Nylon Typhoon
APT15 is a China-nexus (PRC/MSS-linked) cyberespionage threat actor, also referred to as Ke3chang. In the provided content, APT15 is specifically associated with the use of steganographic techniques in operations (noted alongside other MSS-linked APTs) and is referenced in reporting on exploitation of Fortinet FortiOS SSL VPN vulnerabilities. Fortinet reporting cited APT15 (Ke3chang) as one of the Chinese threat groups exploiting older Fortinet SSL VPN flaws (CVE-2022-42475 and CVE-2023-27997), indicating a capability and interest in leveraging edge-device vulnerabilities for initial access. No additional high-confidence details on APT15’s specific victimology, malware families, or sub-groups are directly provided in the content beyond these associations.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Vixen Panda is a China-nexus group targeting cloud infrastructure to steal intellectual property from European organizations.
APT15 has used steganography to hide malware inside image files, facilitating covert cyber operations.
APT15 is a China-backed threat actor known for cyber-espionage campaigns targeting government entities, foreign ministries, and high-value organizations. Recently, it has been involved in attacks against cybersecurity vendors and other sectors using malware such as ShadowPad and GOREshell.
APT15 is a Chinese cyber espionage group linked to the PurpleHaze campaign, involved in targeting global organizations for intelligence gathering.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.