APT10
Also known as: menuPass, Stone Panda, Cicada, POTASSIUM, Red Apollo
APT10 is best known for compromising managed service providers and then using the trusted access those providers have to reach many customers at once. Its long-running campaigns made MSP security and third-party access a mainstream risk topic.
- Public attribution
- A 2018 US indictment says members acted in association with the Tianjin State Security Bureau of China's Ministry of State Security (MSS).
- Active since
- Around 2006
- Targets
- Managed IT service providers (MSPs) and their clients
- Healthcare, defence, aerospace, finance, maritime and energy
- Government agencies
- Organisations in Japan in particular
Notable campaigns
2016-2017Operation Cloud Hopper
PwC UK and BAE Systems, working with the UK NCSC, reported sustained targeting of MSPs and their clients worldwide.
2018US indictment of two members
The DOJ charged two Chinese nationals over intrusions affecting MSPs, more than 45 technology companies and US government agencies.
Signature ATT&CK techniques
- T1199Trusted Relationship
- T1078Valid Accounts
- T1566.001Phishing: Spearphishing Attachment
- T1574.001Hijack Execution Flow: DLL
- T1021.001Remote Services: Remote Desktop Protocol
- T1560.001Archive Collected Data: Archive via Utility
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Give service providers separate, least-privilege accounts with MFA, and log and review everything they do.
- Write security requirements and breach notification into MSP contracts.
- Restrict RDP to jump hosts and alert on new remote logon paths.
- Watch for large archives being created on servers before exfiltration.