APT15Threat actor
- bronze davenport
- bronze idlewood
- bronze palace
- g0004
- GREF
- ke3chang
- lurid
- metushy
- nylon typhoon
- playful dragon
- red vulture
- river castle
- royal apt
- royalapt
- social network team
- vixen panda
This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.From MISP Galaxy
Last reported 8 months ago, by ESET WeLiveSecurity1 report
Suspected originChinaMISP Galaxy
Targets sectorsGovernmentMISP Galaxy
Targets countriesIndia, United Kingdom, GermanyMISP Galaxy
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1033System Owner/User Discovery
“T1033”
- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan“In 2023 China-aligned APT group GREF used BadBazaar Android malware to secretly autolink victims’ Signal accounts to the attacker’s device, which allowed the threat actor to spy on their victims’ Signal communications.”
Indicators in its reports
named in the reports above- hxxps://hitpak[.]org/notepad2.dllin 1 report
- hitpak[.]orgin 1 report
- hxxps://foxy580.github[.]io/koko/file.dllin 1 report
- foxy580.github[.]ioin 1 report
- hxxps://buildthenations[.]info/PKCERT/pkcert.htmlin 1 report
- buildthenations[.]infoin 1 report
- hxxps://hitpak[.]org/page.php?tynor=in 1 report
- b15b1f3f2227eba4…df34b9d30b6ain 1 report
- 8b103d0aa37e5297…fd4f6b2ecbaain 1 report
- 188.114.96[.]10in 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.