Threat actors from the state-sponsored APT15 organization have resurfaced alongside a new attack campaign that has been ongoing since 2022. The APT15 group, also tracked under the codename Ke3Chang/Mirage, has been operating since 2010 and primarily focuses on exploiting organizations involved with diplomatic missions, defense, and government entities. Operating at a less-aggressive pace than other Chinese nation-state threat groups, APT15 continues to exfiltrate intelligence from its targets to benefit the Chinese state. APT15 has deployed an arsenal of malicious payloads in their tenure, including multiple variants of the “BS2005” backdoor in addition to “TidePool”, “Okrum”, “RoyalDNS”, “RoyalCli”, and several other malware families. In their most recent campaign, APT15 turned its focus to the Americas, primarily exploiting foreign affairs ministries and government financial organizations. APT15 has continued to deploy the “Graphican” backdoor in a majority of this campaign’s attacks and advanced further by living-off-the-land scripts and tooling. Specific to the Graphican backdoor, this malicious application was built around the “Ketrican” backdoor, an advanced version of the BS2005 backdoor. Graphican has the capabilities of both malware strains but implements a command-and-control (C2) connection stream through the use of Microsoft’s Graph API and OneDrive applications. Deeper technical information about the malicious Graphican application can be reviewed in the articles below. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.