Ke3chang

Introduction

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010. Mandiant Operation Ke3chang November 2014 NCC Group APT15 Alive and Strong APT15 Intezer June 2018 Microsoft NICKEL December 2021

Activities and Tactics

Targeted Sectors: Government, Administration, Government

Country of Origin: 🇨🇳 China

Incident Type: Espionage

Suspected Victims: European Union, India, United Kingdom, Germany

Notable Campaigns

• SPACEHOP Activity (C0052): SPACEHOP Activity is conducted through commercially leased Virtual Private Servers (VPS), otherwise known as provisioned Operational Relay Box (ORB) networks. The network leveraged for SPACEHOP Activity enabled China-nexus cyber threat actors – such as APT5 and Ke3chang – to perform network reconnaissance scanning and vulnerability exploitation. SPACEHOP Activity has historically targeted entities in North America, Europe, and the Middle East.(Citation: ORB Mandiant)

Tactics, Techniques, and Procedures (TTPs)

• T1114.002 Remote Email Collection
• T1105 Ingress Tool Transfer
• T1087.001 Local Account
• T1033 System Owner/User Discovery
• T1614.001 System Language Discovery
• T1087.002 Domain Account
• T1140 Deobfuscate/Decode Files or Information
• T1558.001 Golden Ticket
• T1021.002 SMB/Windows Admin Shares
• T1041 Exfiltration Over C2 Channel
• T1119 Automated Collection
• T1083 File and Directory Discovery
• T1133 External Remote Services
• T1018 Remote System Discovery
• T1003.002 Security Account Manager
• T1016 System Network Configuration Discovery
• T1588.002 Tool
• T1020 Automated Exfiltration
• T1007 System Service Discovery
• T1543.003 Windows Service
• T1190 Exploit Public-Facing Application
• T1036.005 Match Legitimate Resource Name or Location
• T1569.002 Service Execution
• T1005 Data from Local System
• T1071.004 DNS
• T1213.002 Sharepoint
• T1027 Obfuscated Files or Information
• T1059 Command and Scripting Interpreter
• T1036.002 Right-to-Left Override
• T1560 Archive Collected Data
• T1069.002 Domain Groups
• T1560.001 Archive via Utility
• T1003.003 NTDS
• T1057 Process Discovery
• T1003.001 LSASS Memory
• T1587.001 Malware
• T1071.001 Web Protocols
• T1059.003 Windows Command Shell
• T1078 Valid Accounts
• T1583.005 Botnet
• T1547.001 Registry Run Keys / Startup Folder
• T1049 System Network Connections Discovery
• T1056.001 Keylogging
• T1003.004 LSA Secrets
• T1078.004 Cloud Accounts
• T1082 System Information Discovery

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.002
• T1003.003
• T1003.004
• T1005
• T1007
• T1016
• T1018
• T1020
• T1021.002
• T1027
• T1033
• T1036.002
• T1036.005
• T1041
• T1049
• T1056.001
• T1057
• T1059
• T1059.003
• T1069.002
• T1071.001
• T1071.004
• T1078
• T1078.004
• T1082
• T1083
• T1087.001
• T1087.002
• T1105
• T1114.002
• T1119
• T1133
• T1140
• T1190
• T1213.002
• T1543.003
• T1547.001
• T1558.001
• T1560
• T1560.001
• T1569.002
• T1583.005
• T1587.001
• T1588.002
• T1614.001

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• China Chopper:

MITRE ATT&CK Software

• Ping (S0097) — tool
• Okrum (S0439) — malware
• Systeminfo (S0096) — tool
• netstat (S0104) — tool
• spwebmember (S0227) — tool
• Mimikatz (S0002) — tool
• Tasklist (S0057) — tool
• MirageFox (S0280) — malware
• Net (S0039) — tool
• Neoichor (S0691) — malware
• ipconfig (S0100) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [11] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [12] Microsoft NICKEL December 2021 MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022. [13] APT15 Intezer June 2018 Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018. [14] NCC Group APT15 Alive and Strong Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. [15] Mandiant Operation Ke3chang November 2014 Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. [16] Villeneuve et al 2014 Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.