Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0004
MITRE ATT&CK Group

Ke3chang (G0004)

APT15MirageVixen PandaGREFPlayful DragonRoyalAPTNICKELNylon Typhoon
ShareXLinkedInRedditHN

[Ke3chang](https://attack.mitre.org/groups/G0004) is a threat group attributed to actors operating out of China. [Ke3chang](https://attack.mitre.org/groups/G0004) has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

▪Techniques used (46)

T1114.002Remote Email CollectionT1105Ingress Tool TransferT1087.001Local Account

▪Software used (11)

S0097PingtoolS0439Okrummalware
G0004 on MITRE ATT&CK →
T1033System Owner/User Discovery
T1614.001System Language Discovery
T1087.002Domain Account
T1140Deobfuscate/Decode Files or Information
T1558.001Golden Ticket
T1021.002SMB/Windows Admin Shares
T1041Exfiltration Over C2 Channel
T1119Automated Collection
T1083File and Directory Discovery
T1133External Remote Services
T1018Remote System Discovery
T1003.002Security Account Manager
T1016System Network Configuration Discovery
T1588.002Tool
T1020Automated Exfiltration
T1007System Service Discovery
T1543.003Windows Service
T1190Exploit Public-Facing Application
T1036.005Match Legitimate Resource Name or Location
T1569.002Service Execution
T1005Data from Local System
T1071.004DNS
T1213.002Sharepoint
T1027Obfuscated Files or Information
T1059Command and Scripting Interpreter
T1036.002Right-to-Left Override
T1560Archive Collected Data
T1069.002Domain Groups
T1560.001Archive via Utility
T1003.003NTDS
T1057Process Discovery
T1003.001LSASS Memory
T1587.001Malware
T1071.001Web Protocols
T1059.003Windows Command Shell
T1078Valid Accounts
T1583.005Botnet
T1547.001Registry Run Keys / Startup Folder
T1049System Network Connections Discovery
T1056.001Keylogging
T1003.004LSA Secrets
T1078.004Cloud Accounts
T1082System Information Discovery
S0096Systeminfotool
S0104netstattool
S0227spwebmembertool
S0002Mimikatztool
S0057Tasklisttool
S0280MirageFoxmalware
S0039Nettool
S0691Neoichormalware
S0100ipconfigtool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.