APT15 — Threat Actors — SecurityStudies.info

Profile

Also known as: BRONZE DAVENPORT, BRONZE IDLEWOOD, BRONZE PALACE, G0004, GREF, Ke3Chang, Lurid, Metushy, Mirage, NICKEL, Nylon Typhoon, Playful Dragon, Red Vulture, RIVER CASTLE, Royal APT, RoyalAPT, Social Network Team, VIXEN PANDA

This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage purposes.

Related profiles: GREF, PurpleHaze

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 46

Resource Development

T1583.005Botnet T1587.001Malware T1588.002Tool

Initial Access

T1078Valid Accounts T1078.004Cloud Accounts T1133External Remote Services T1190Exploit Public-Facing Application

Execution

T1059Command and Scripting Interpreter T1059.003Windows Command Shell T1569.002Service Execution

Persistence

T1543.003Windows Service T1547.001Registry Run Keys / Startup Folder

Stealth

T1027Obfuscated Files or Information T1036.002Right-to-Left Override T1036.005Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information

Credential Access

T1003.001LSASS Memory T1003.002Security Account Manager T1003.003NTDS T1003.004LSA Secrets T1056.001Keylogging T1558.001Golden Ticket

Discovery

T1007System Service Discovery T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery T1069.002Domain Groups T1082System Information Discovery T1083File and Directory Discovery T1087.001Local Account T1087.002Domain Account T1614.001System Language Discovery

Lateral Movement

T1021.002SMB/Windows Admin Shares

Collection

T1005Data from Local System T1114.002Remote Email Collection T1119Automated Collection T1213.002Sharepoint T1560Archive Collected Data T1560.001Archive via Utility

Command and Control

T1071.001Web Protocols T1071.004DNS T1105Ingress Tool Transfer

Exfiltration

T1020Automated Exfiltration T1041Exfiltration Over C2 Channel

Incidents attributed

No incident in the register is attributed to this actor.

In the news

Updated Cyber Threat Actor Naming System
Google Threat Intelligence · Jul 24, 2026

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential