Cyber Resilience

Threat actor · all actors

Ke3changG0004 state

🇨🇳 CN

aka Ke3chang, APT15, Mirage, Vixen Panda, GREF, Playful Dragon, RoyalAPT, NICKEL, Nylon Typhoon, Metushy, Lurid, Social Network Team, Royal APT, BRONZE PALACE, BRONZE DAVENPORT, BRONZE IDLEWOOD, G0004, Red Vulture, RIVER CASTLE

Last updated: 2026-08-21

1attributed CVEs
63ATT&CK techniques
3.2IDF score (tooling uniqueness)
0exclusive CVEs
2026years active

About this actor

GREF is a China-aligned APT group that has been active since at least March 2017. They are known for using custom backdoors, loaders, and ancillary tools in their targeted attacks. Recently, they have been attributed to two active Android campaigns that distribute the BadBazaar malware through malicious apps on official and alternative app stores. GREF has targeted Android users, particularly Uyghurs and other Turkic ethnic minorities outside of China, using trojanized versions of popular messaging apps like Signal and Telegram.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0004

Microsoftweather-system names

Nylon Typhoon

CrowdStrikenation-animal names

Vixen PandaPlayful Dragon

Mandiant / genericAPT numbering

APT15

Secureworkscolour-metal names

BRONZE PALACEBRONZE DAVENPORTBRONZE IDLEWOOD

Unclassifiedno scheme matched

Ke3changMirageGREFRoyalAPTNICKELMetushyLuridSocial Network TeamRoyal APTRed VultureRIVER CASTLE

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 63 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2026-21236 5.87.80.00422026-02-10see CVE

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-436 / 6357%
CM-633 / 6352%
CM-230 / 6348%
AC-329 / 6346%
AC-225 / 6340%
AC-625 / 6340%
CM-725 / 6340%
CA-723 / 6337%
SI-323 / 6337%
IA-222 / 6335%
AC-519 / 6330%
CM-519 / 6330%
SI-718 / 6329%
AC-414 / 6322%
IA-513 / 6321%

Co-occurring actors

Similar actors

Similar TTPs

Overlapping CVEs

Active in same years

Same nation-state

Same category