NCC Group APT15 Alive and Strong

Ke3chang has dumped credentials, including by using Mimikatz.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang has dumped credentials, including by using gsecdump.

Ke3chang has performed local network configuration discovery using ipconfig.

Ke3chang has used network scanning and enumeration tools, including Ping.

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.

Ke3chang performs local network connection discovery using netstat.

Ke3chang has used keyloggers.

Ke3chang performs process discovery using tasklist commands.

Malware used by Ke3chang can run commands on the command-line interface.

Ke3chang has used batch scripts in its malware to install persistence mechanisms.

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Ke3chang malware RoyalDNS has used DNS for C2.

Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.

spwebmember is used to enumerate and dump information from Microsoft SharePoint.

Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Several Ke3chang backdoors achieved persistence by adding a Run key.

Ke3chang has used Mimikatz to generate Kerberos golden tickets.

Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Ke3chang has obtained and used tools such as Mimikatz.