Loading story…
Recovered eDiary files and related forensic evidence have been cited as linking APT15 activity to the PLA Cyberspace Force’s 8th Technical Reconnaissance Base, also known as Unit 61046. Reporting says the material contains operational notes, exploit logs, victim research, mailbox screenshots, and stolen credentials tied to multiple government targets, including the Royal Thailand Armed Forces. Searches for terms associated with APT15, particularly vpnkerio, reportedly produced matches in the same diary data that referenced the 8th TRB, strengthening claims that the group’s infrastructure, targeting, and tradecraft overlap with a Chinese military unit.
The intrusion workflow described in the recovered records aligns with previously documented APT15 tactics, including exploitation of CVE-2020-0688 against Microsoft Exchange. According to the reporting, attackers used a Python-based exploit chain to redirect victims to infrastructure associated with vpnkerio[.]com, deliver kerio.exe, and install a webshell for follow-on access. The combined evidence has been presented as support for attributing APT15 operations to a PLA espionage organization rather than to loosely affiliated contractors or purely commercial operators.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The same reporting described an intrusion chain in which a Python script exploited CVE-2020-0688, redirected victims to infrastructure associated with vpnkerio[.]com, downloaded "kerio.exe," and deployed a webshell. This constituted a technical disclosure about the tooling and workflow used in the activity.
An analysis of recovered eDiary files found references tying APT15 activity, including searches for "vpnkerio," to the PLA Cyberspace Force’s 8th Technical Reconnaissance Base (Unit 61046). The material allegedly included operational notes, exploit logs, victim research, mailbox screenshots, and credential data from multiple government targets.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked the Chinese-aligned espionage group **Ke3chang**/**APT15** to a sustained campaign against diplomatic organizations, tying together older **RoyalDNS** and **RoyalCLI** activity with newer **Ketrican** malware and a previously undocumented backdoor named **Okrum**. ESET reported that Okrum was first detected in late 2016 and used against diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil, extending a broader pattern of targeting government and foreign affairs entities in Europe and Latin America that earlier reporting had associated with Operation Ke3chang. The malware set shows an actor that has refreshed its tooling while preserving tradecraft across multiple years. Okrum provides basic backdoor access and depends heavily on manually executed shell commands and external utilities, while related tools used evasion techniques including payloads hidden in PNG files, anti-sandbox checks, and frequently changed loaders. Combined reporting from ESET, NCC Group, FireEye, and Intezer indicates APT15 remained active from at least 2015 through 2019, resurfacing with updated implants derived from older ones as it continued cyberespionage operations against diplomatic targets.
Aug 15, 2026
Researchers and independent investigators tied the Chinese cyber-espionage group **APT3**—also tracked as **Gothic Panda**, **Buckeye**, **UPS Team**, and **TG-0110**—to long-running intrusions targeting government, research, technology, aerospace, defense, transport, manufacturing, and telecommunications organizations. Reporting says the group used spear-phishing, browser and Flash **zero-day** exploits including `CVE-2014-1776`, `CVE-2014-6332`, and `CVE-2015-3113`, then deployed the **Pirpi** remote access trojan to move laterally, install backdoors, and steal intellectual property and other confidential data, initially focusing on the United States and United Kingdom before expanding activity to Hong Kong. Technical analysis found APT3 repeatedly reused exploit components, shellcode, steganographic delivery through animated GIFs, and command-and-control patterns across campaigns, with Pirpi variants sharing encrypted HTTP cookie-based communications and similar command loops while newer builds added stronger obfuscation and anti-analysis features. Separate attribution research claimed historic DNS and WHOIS records linked infrastructure such as `httb[.]net`, `vcersoft[.]com`, `uyre[.]net`, `inc-work[.]com`, `microsoft-ie[.]com`, `unixfocus[.]net`, and `shuyan[.]com` to alleged operators including **Wu Yingzhuo** and **Dong Hao**, arguing that shared registration artifacts exposed personnel behind the espionage activity.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that the **PKPLUG** intrusion set conducted long-running cyber espionage operations across Asia, particularly in Southeast Asia, and assessed with high confidence that the activity is tied to Chinese nation-state adversaries. The group was described as active for at least six years and focused on targets in **Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet, and Xinjiang**, indicating intelligence collection against politically and geopolitically sensitive organizations and communities. The campaigns used a combination of public and custom malware, including **PlugX**, **Poison Ivy**, **Zupdax**, **9002**, **HenBox**, and the previously unknown Windows backdoor **Farseer**, with **DLL side-loading** and **spear-phishing** repeatedly used for delivery and execution. Unit 42 said overlapping infrastructure, malware characteristics, and shared tactics connected multiple previously reported operations under the PKPLUG umbrella, while **HenBox** expanded the threat to Android devices—especially targeting **Uyghurs** and **Xiaomi** devices—and the researchers released a **STIX 2.0** adversary playbook consolidating indicators, campaigns, and ATT&CK-mapped techniques.
Jun 29, 2026