Operation Ke3chang Resurfaces With New TidePool Malware - Palo Alto Networks BlogPalo Alto Networks Blog

Unit 42 reports that Operation Ke3chang has resurfaced using a new malware family named TidePool, which is delivered via spearphishing MHTML documents exploiting CVE-2015-2545. TidePool functions as a RAT (file operations, command execution, HTTP C2 with Base64-encoded beacons), maintains persistence via ActiveSetup and registry modifications (notably disabling IE hardening), and shows clear code reuse with earlier BS2005/Ke3chang samples; the report includes numerous IOCs (hashes and the C2 domain goback.strangled.net).