Threat feed IOCs (49)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT15. Each row shows why it was linked and where it came from.

Public research & publications (20)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• attack.mitre.orghttps://attack.mitre.org/groups/G0004
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• research.nccgroup.comhttps://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
• web.archive.orghttps://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/
• fireeye.comhttps://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-ke3chang.pdf
• mandiant.comhttps://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs
• microsoft.comhttps://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html
• arstechnica.comhttp://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/
• github.comhttps://github.com/nccgroup/Royal_APT
• cfr.orghttps://www.cfr.org/interactive/cyber-operations/mirage
• unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
• intezer.comhttps://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/
• attack.mitre.orghttps://attack.mitre.org/groups/G0004/
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/bronze-palace
• mandiant.comhttps://www.mandiant.com/resources/insights/apt-groups
• pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
• query.prod.cms.rt.microsoft.comhttps://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi
• bsi.bund.dehttps://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/