SOC Prime Bias: Critical

16 Dec 2025 19:22
newspaper icon picussecurity.com

APT15 Cyber Espionage: Campaigns and TTPs Analysis

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
APT15 Cyber Espionage: Campaigns and TTPs Analysis
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

APT15 is a Chinese state-sponsored cyber espionage group active since 2010, primarily targeting government agencies, diplomatic missions and military organisations. The actors rely on spear-phishing, exploitation of public-facing applications and custom backdoors to gain initial access and maintain long-term footholds. Their toolkit includes steganography, masquerading, registry manipulation and encrypted C2 channels embedded in HTTP headers or DNS traffic. The campaign continues to evolve with new tools such as Graphican and the ORB3 relay network.

Investigation

The investigation mapped multiple malware families (BS2005, TidePool, MirageFox, Graphican, etc.) and a comprehensive set of ATT&CK techniques spanning initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, collection, exfiltration and command-and-control. Analysts extracted concrete indicators including domains, file paths, registry keys and command lines from the case data. The group’s infrastructure leverages domains such as goback.stranged.net and finance.globaleducat.com for C2 operations.

Mitigation

Recommended defence measures include rigorous scanning of email attachments, prompt patching of Microsoft Exchange, SharePoint and VPN appliances, and monitoring for suspicious registry modifications, abnormal scheduled tasks, and rundll32 or COM-based payload execution. Network monitoring should focus on atypical HTTP cookie activity and DNS TXT queries aligned with known C2 patterns. Application whitelisting and behavioural analytics can help block the use of renamed archivers and steganography-based PNG payloads.

Response

When APT15 activity is detected, isolate the affected host, capture volatile data and all related IOC artifacts, and block the identified C2 domains and IP addresses. Perform full forensic analysis to locate persistent shortcuts, scheduled tasks and registry changes, then eradicate malicious components and reset any compromised credentials. Inform impacted users and update detection rules to cover the observed command lines, file paths and infrastructure indicators.

"graph TB %% Class definitions classDef technique fill:#99ccff classDef operator fill:#ff9900 %% Node definitions node_initial["<b>Technique</b> – <b>T1566.001 Spearphishing Attachment</b><br/><b>Description</b>: Send targeted emails with malicious attachments to gain initial access."] class node_initial technique node_valid["<b>Technique</b> – <b>T1078 Valid Accounts</b><br/><b>Description</b>: Use compromised legitimate credentials to access systems."] class node_valid technique node_exploit["<b>Technique</b> – <b>T1190 Exploit Public-Facing Application</b><br/><b>Description</b>: Exploit vulnerabilities in internetu2011facing services to gain access."] class node_exploit technique node_cmd["<b>Technique</b> – <b>T1059.003 Windows Command Shell</b><br/><b>Description</b>: Execute commands via cmd.exe to run malicious code."] class node_cmd technique node_shortcut["<b>Technique</b> – <b>T1547.009 Shortcut Modification</b><br/><b>Description</b>: Create or modify LNK shortcuts for persistence."] class node_shortcut technique node_task["<b>Technique</b> – <b>T1053 Scheduled Task</b><br/><b>Description</b>: Use scheduled tasks to execute payloads at defined times."] class node_task technique node_active["<b>Technique</b> – <b>T1547.014 Active Setup</b><br/><b>Description</b>: Leverage Active Setup registry keys for persistence."] class node_active technique node_token["<b>Technique</b> – <b>T1134.003 Access Token Manipulation</b><br/><b>Description</b>: Assume higher privileges by altering access tokens."] class node_token technique node_steg["<b>Technique</b> – <b>T1027.003 Steganography</b><br/><b>Description</b>: Hide data within other files to evade detection."] class node_steg technique node_masq["<b>Technique</b> – <b>T1036 Masquerading</b><br/><b>Description</b>: Rename files or disguise as legitimate to avoid detection."] class node_masq technique node_icon["<b>Technique</b> – <b>T1027.012 LNK Icon Smuggling</b><br/><b>Description</b>: Embed malicious code in LNK icon resources."] class node_icon technique node_proxy["<b>Technique</b> – <b>T1218 System Binary Proxy Execution</b><br/><b>Description</b>: Abuse trusted system binaries to run malicious code."] class node_proxy technique node_guard["<b>Technique</b> – <b>T1480.001 Execution Guardrails</b><br/><b>Description</b>: Verify environment conditions before execution."] class node_guard technique node_sandbox["<b>Technique</b> – <b>T1497 Sandbox Evasion</b><br/><b>Description</b>: Detect and evade analysis sandbox environments."] class node_sandbox technique node_keylog["<b>Technique</b> – <b>T1056.001 Keylogging</b><br/><b>Description</b>: Capture keystrokes to obtain credentials."] class node_keylog technique node_dump["<b>Technique</b> – <b>T1003 OS Credential Dumping</b><br/><b>Description</b>: Extract password hashes from the operating system."] class node_dump technique node_sysinfo["<b>Technique</b> – <b>T1082 System Information Discovery</b><br/><b>Description</b>: Gather OS, hardware, and software details."] class node_sysinfo technique node_inet["<b>Technique</b> – <b>T1016.001 Internet Connection Discovery</b><br/><b>Description</b>: Identify active network connections and IP addresses."] class node_inet technique node_stage["<b>Technique</b> – <b>T1074.001 Data Staged</b><br/><b>Description</b>: Accumulate data locally before exfiltration."] class node_stage technique node_archive["<b>Technique</b> – <b>T1560.001 Archive via Utility</b><br/><b>Description</b>: Compress data using utilities such as zip."] class node_archive technique node_email["<b>Technique</b> – <b>T1114.002 Remote Email Collection</b><br/><b>Description</b>: Access email accounts to collect messages."] class node_email technique node_http["<b>Technique</b> – <b>T1071.001 Web Protocols HTTP</b><br/><b>Description</b>: Use HTTP for command and control communications."] class node_http technique node_obfusc["<b>Technique</b> – <b>T1001 Data Obfuscation</b><br/><b>Description</b>: Encode or encrypt data to hide its content."] class node_obfusc technique node_dead["<b>Technique</b> – <b>T1102.001 Dead Drop Resolver</b><br/><b>Description</b>: Retrieve commands or data from hidden locations."] class node_dead technique node_encrypt["<b>Technique</b> – <b>T1573.001 Encrypted Channel</b><br/><b>Description</b>: Encrypt C2 traffic to conceal communications."] class node_encrypt technique node_exfil["<b>Technique</b> – <b>T1048.003 Exfiltration Over Unencrypted Non C2 Protocol</b><br/><b>Description</b>: Transfer data using protocols not associated with C2 without encryption."] class node_exfil technique %% Connections node_initial –>|leads_to| node_valid node_initial –>|leads_to| node_exploit node_valid –>|leads_to| node_cmd node_cmd –>|enables| node_shortcut node_cmd –>|enables| node_task node_cmd –>|enables| node_active node_cmd –>|enables| node_token node_cmd –>|enables| node_steg node_cmd –>|enables| node_masq node_cmd –>|enables| node_icon node_cmd –>|enables| node_proxy node_cmd –>|enables| node_guard node_cmd –>|enables| node_sandbox node_cmd –>|enables| node_keylog node_cmd –>|enables| node_dump node_cmd –>|enables| node_sysinfo node_cmd –>|enables| node_inet node_sysinfo –>|feeds| node_stage node_inet –>|feeds| node_stage node_stage –>|includes| node_archive node_stage –>|includes| node_email node_archive –>|used_by| node_http node_email –>|used_by| node_http node_http –>|uses| node_obfusc node_http –>|uses| node_dead node_http –>|uses| node_encrypt node_http –>|exfiltrates_via| node_exfil "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Attack Narrative & Commands:

  1. Preparation: The adversary has already compromised a user account and landed on the endpoint.
  2. Data Staging (T1059.003): Using the exact xcopy syntax observed in historic APT15 activity, the attacker copies the victim’s desktop files to a hidden WMI temporary folder, preserving timestamps (/D:09-29-2021) to blend with legitimate system activity.
  3. Payload Execution (T1218.002): The attacker then invokes rundll32.exe with a short‑named path (C:DOCUME~1ALLUSE~1IEHelpermshtml.dll) to execute malicious JavaScript that establishes persistence.
  4. Outcome: Both commands generate distinct process‑creation events that match the Sigma rule’s selection1 and selection2 respectively, triggering an alert.

Regression Test Script:

# -------------------------------------------------
# APT15 Simulation Script – triggers Sigma rule
# -------------------------------------------------

# 1. Create staging directories and dummy files
$src = "C:usersREDACTEDDesktop"
$dst = "C:windowstempwmi"
New-Item -Path $src -ItemType Directory -Force | Out-Null
New-Item -Path $dst -ItemType Directory -Force | Out-Null
Set-Content -Path "$srcsecret.txt" -Value "sensitive data" -Encoding UTF8

# 2. Execute the exact xcopy command used by APT15
$xcopyCmd = "xcopy /D:09-29-2021 /S/Y/C c:usersREDACTEDDesktop c:windowstempwmi"
Invoke-Expression $xcopyCmd

# 3. Deploy the malicious DLL (simulated by copying a legit DLL)
$malDllSrc = "$env:SystemRootSystem32mshtml.dll"
$malDllDst = "C:DOCUME~1ALLUSE~1IEHelpermshtml.dll"
New-Item -Path (Split-Path $malDllDst) -ItemType Directory -Force | Out-Null
Copy-Item -Path $malDllSrc -Destination $malDllDst -Force

# 4. Execute rundll32 with the exact APT15 argument pattern
$rundllCmd = "rundll32.exe C:DOCUME~1ALLUSE~1IEHelpermshtml.dll, IEHelper"
Invoke-Expression $rundllCmd

# -------------------------------------------------
# End of simulation
# -------------------------------------------------

Cleanup Commands:

# Remove staging files and directories
Remove-Item -Path "C:usersREDACTEDDesktopsecret.txt" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:windowstempwmi" -Recurse -Force -ErrorAction SilentlyContinue

# Remove the fake IEHelper folder and DLL
Remove-Item -Path "C:DOCUME~1ALLUSE~1IEHelper" -Recurse -Force -ErrorAction SilentlyContinue

# Optional: stop Sysmon (if only needed for test)
# & "$env:ProgramFilesSysinternalsSysmon.exe" -u

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free