Loading story…
Researchers linked the Chinese-aligned espionage group Ke3chang/APT15 to a sustained campaign against diplomatic organizations, tying together older RoyalDNS and RoyalCLI activity with newer Ketrican malware and a previously undocumented backdoor named Okrum. ESET reported that Okrum was first detected in late 2016 and used against diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil, extending a broader pattern of targeting government and foreign affairs entities in Europe and Latin America that earlier reporting had associated with Operation Ke3chang.
The malware set shows an actor that has refreshed its tooling while preserving tradecraft across multiple years. Okrum provides basic backdoor access and depends heavily on manually executed shell commands and external utilities, while related tools used evasion techniques including payloads hidden in PNG files, anti-sandbox checks, and frequently changed loaders. Combined reporting from ESET, NCC Group, FireEye, and Intezer indicates APT15 remained active from at least 2015 through 2019, resurfacing with updated implants derived from older ones as it continued cyberespionage operations against diplomatic targets.
TTPs, infrastructure, and targeting history in one profile.
11 events from the most recent confirmed update back to the earliest known activity.
Intezer reported a newly identified malware family named Ketrum and attributed it to Ke3chang/APT15 based on shared code and infrastructure with the older Ketrican and Okrum backdoors. The report said samples uploaded in December 2019 and May 2020 showed Ketrum as a hybrid evolution of those malware families.
In March 2019, ESET detected a new Ketrican sample that evolved from the 2018 Ketrican backdoor and attacked the same targets.
ESET discovered a new Ketrican backdoor version in 2018 that included code improvements over earlier variants.
In 2017, the same entities affected by Okrum and the 2015 Ketrican activity were targeted again using RoyalDNS and a Ketrican backdoor compiled that year.
During 2017, Okrum was used against diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil, with particular focus on Slovak targets.
ESET first detected the previously undocumented Okrum backdoor in December 2016 and linked it to the Ke3chang threat group.
In May 2016, Unit 42 reported that Operation Ke3chang was still active and identified TidePool as a new malware family evolved from the group's earlier BS2005 malware. The campaign targeted Indian embassy personnel worldwide with spear-phishing MHTML documents exploiting CVE-2015-2545.
In 2015, ESET identified suspicious activity in European countries including Slovakia, Croatia, and the Czech Republic involving malware it later referred to as Ketrican. The malware showed ties to BS2005 backdoors from Operation Ke3chang and to the TidePool family.
A FireEye report published in 2013 documented Operation Ke3chang and its targeting of diplomatic organizations in Europe.
FireEye documented Operation Ke3chang as targeting diplomatic organizations in Europe and traced Ke3chang activity back to 2010.
ESET published research concluding with high confidence that Okrum is operated by Ke3chang and that Okrum, Ketrican, and RoyalDNS activity observed after 2015 are linked to the same long-running actor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 58 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
intezer.com
Open sourcewelivesecurity.com
Open sourceresearchcenter.paloaltonetworks.com
Open sourceunit42.paloaltonetworks.com
Open sourcenccgroup.trust
Open sourcefireeye.com
Open sourceintezer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
State-backed advanced persistent threat (APT) groups have intensified their cyber espionage activities, employing increasingly sophisticated tactics, techniques, and procedures (TTPs) to infiltrate and persist within high-value targets. APT15, believed to operate out of China, has conducted a series of high-profile campaigns targeting government entities, defense contractors, and minority groups across Europe, North America, and Asia. Their operations leverage spear phishing, exploitation of public-facing applications, and advanced defense evasion methods such as steganography and masquerading malware as legitimate software. Similarly, the Iranian group Charming Kitten (APT35) has been exposed through recent leaks, revealing the identities of key personnel, financial structures, and thousands of compromised systems worldwide. These leaks detail how the group uses spear-phishing, fake login pages, and malicious attachments to gain initial access, followed by persistent surveillance and data exfiltration from government, academic, and civil society networks. Technical analysis of these groups' operations highlights the use of legitimate system tools for lateral movement and persistence, as well as complex command-and-control (C2) infrastructures designed to evade detection. The leaks concerning Charming Kitten provide unprecedented insight into the operational management and financial underpinnings of Iranian cyber espionage, including the use of front companies and detailed tasking sheets. Both APT15 and APT35 demonstrate the ongoing evolution of state-sponsored cyber threats, with a focus on stealth, persistence, and the targeting of sensitive information across multiple sectors and geographies.
Jun 29, 2026
Recovered `eDiary` files and related forensic evidence have been cited as linking **APT15** activity to the PLA Cyberspace Force’s **8th Technical Reconnaissance Base**, also known as **Unit 61046**. Reporting says the material contains operational notes, exploit logs, victim research, mailbox screenshots, and stolen credentials tied to multiple government targets, including the **Royal Thailand Armed Forces**. Searches for terms associated with APT15, particularly `vpnkerio`, reportedly produced matches in the same diary data that referenced the 8th TRB, strengthening claims that the group’s infrastructure, targeting, and tradecraft overlap with a Chinese military unit. The intrusion workflow described in the recovered records aligns with previously documented APT15 tactics, including exploitation of **`CVE-2020-0688`** against Microsoft Exchange. According to the reporting, attackers used a Python-based exploit chain to redirect victims to infrastructure associated with `vpnkerio[.]com`, deliver `kerio.exe`, and install a webshell for follow-on access. The combined evidence has been presented as support for attributing APT15 operations to a PLA espionage organization rather than to loosely affiliated contractors or purely commercial operators.
Jul 28, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026