Microsoft security researchers and legal teams have obtained a warrant from the Eastern Virginia United States District Court allowing them to seize multiple domains tied to the Chinese cyber espionage threat group Nickel; tracked as APT15, Mirage, Vixen Panda, and Ke3Chang. Nickel threat actors have been active since 2012 and have conducted several cyberattacks against a broad range of targets over the past decade. Recent activity surrounding forty-two (42) domains operated by the threat actors have been utilized for espionage tactics and intelligence gathering from human rights organizations, government agencies, and think tanks. Threat actors of the group attempted exploitation of their targets through sophisticated spear-phishing campaigns, attempting to breach systems including Microsoft Exchange, Pulse Secure VPNs, and SharePoint. Post exploitation, Nickel actors commonly deployed a keylogger for credential harvesting alongside additional malicious scripts which would allow communications between the infected device and threat actors via command-and-control (C2) server(s). CTAPT will continue to monitor the movements of this entity and provide updates accordingly.