{
  "id": "ke3chang",
  "name": "Ke3chang",
  "aliases": [
    "APT15",
    "Mirage",
    "Vixen Panda",
    "GREF",
    "Playful Dragon",
    "RoyalAPT",
    "NICKEL",
    "Nylon Typhoon"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Actors operating from China",
      "src": [
        "mitre-g0004"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2010,
      "src": [
        "mitre-g0004"
      ],
      "conf": "medium",
      "note": "At least 2010"
    },
    {
      "k": "attack_id",
      "v": "G0004",
      "src": [
        "mitre-g0004"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.",
      "src": [
        "mitre-g0004"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "SPACEHOP Activity (C0052, 2019–2024)",
      "src": [
        "mitre-g0004"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 46,
      "src": [
        "mitre-g0004"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "ipconfig, Mimikatz, MirageFox, Neoichor, Net, netstat, Okrum, Ping, spwebmember, Systeminfo, Tasklist",
      "src": [
        "mitre-g0004"
      ],
      "conf": "high",
      "note": "11 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0004)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/ke3chang.html",
  "sources": {
    "mitre-g0004": {
      "title": "Ke3chang, Group G0004",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0004/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}