Ke3chang (G0004) | Threat Actor Index

About Ke3chang

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.

View MITRE record ↗

Techniques by Tactic (46)

Resource Development

T1583.005 BotnetT1587.001 MalwareT1588.002 Tool

Initial Access

T1078 Valid AccountsT1078.004 Cloud AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application

Execution

T1059 Command and Scripting InterpreterT1059.003 Windows Command ShellT1569.002 Service Execution

Persistence

T1078 Valid AccountsT1078.004 Cloud AccountsT1133 External Remote ServicesT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1078 Valid AccountsT1078.004 Cloud AccountsT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder

Stealth

T1027 Obfuscated Files or InformationT1036.002 Right-to-Left OverrideT1036.005 Match Legitimate Resource Name or LocationT1078 Valid AccountsT1078.004 Cloud AccountsT1140 Deobfuscate/Decode Files or Information

Credential Access

T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1056.001 KeyloggingT1558.001 Golden Ticket

Discovery

T1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1049 System Network Connections DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1087.002 Domain AccountT1614.001 System Language Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares

Collection

T1005 Data from Local SystemT1056.001 KeyloggingT1114.002 Remote Email CollectionT1119 Automated CollectionT1213.002 SharepointT1560 Archive Collected DataT1560.001 Archive via Utility

Command & Control

T1071.001 Web ProtocolsT1071.004 DNST1105 Ingress Tool Transfer

Exfiltration

T1020 Automated ExfiltrationT1041 Exfiltration Over C2 Channel

Toolsets (11)

🐛

MirageFox S0280

Malware · Windows

🐛

Neoichor S0691

Malware · Windows

🐛

Okrum S0439

Malware · Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Ping S0097

Tool

🔧

Systeminfo S0096

Tool

🔧

Tasklist S0057

Tool

🔧

ipconfig S0100

Tool

🔧

netstat S0104

Tool

🔧

spwebmember S0227

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (6)