APT15
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 1 incident
- Sources
- 1 source
- First seen
- 2022-07-01
- Last seen
- 2022-07-01
- Updated
- 2026-10-11 03:30
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Playful Taurus, also tracked as APT15, Nickel, Vixen Panda, BackdoorDiplomacy and KeChang, is a Chinese advanced persistent threat group active since at least 2010. It primarily conducts cyber‑espionage against government and diplomatic entities in regions including North and South America, Africa and the Middle East, as demonstrated by a 2022‑2023 campaign that targeted Iranian government networks using updated variants of the Turian backdoor with enhanced obfuscation and modified command‑and‑control protocols. The group’s activity is attributed to China, reflecting its focus on intelligence gathering rather than financial gain or disruption.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 1 source.