APT15 lives off the land https://www.nccgroup.trust/uk/about...-strong-an-analysis-of-royalcli-and-royaldns/
China-Linked APT15 Develops New 'MirageFox' Malware A cyber-espionage group believed to be operating out of China has developed a new piece of malware that appears to be based on one of the first tools used by the threat actor. June 18, 2018 https://www.securityweek.com/china-linked-apt15-develops-new-miragefox-malware