{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt10",
    "slug": "apt10",
    "name": "APT10",
    "shortName": "APT10",
    "country": "China",
    "countryCode": "CN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2006",
    "prominence": 86,
    "mitreGroupId": "G0045",
    "malpediaSlug": "apt10",
    "tagline": "Operation Cloud Hopper — compromised managed service providers to reach their clients' networks, turning outsourced IT into a single point of failure.",
    "bio": "APT10 pioneered the managed service provider as an attack vector, and in doing so changed how defenders think about third-party risk.\n\nOperation Cloud Hopper, documented by PwC and BAE Systems in 2017, described the group compromising MSPs and then moving through the legitimate management connections those providers maintain into client networks. The economics are brutally favourable: one MSP compromise yields access to dozens or hundreds of downstream organisations, and the intrusion arrives over trusted, expected administrative channels that security teams are unlikely to question.\n\nThe December 2018 U.S. indictment of Zhu Hua and Zhang Shilong tied the group to the Tianjin State Security Bureau through the front company Huaying Haitai Science and Technology Development Co. It also charged a separate long-running campaign against U.S. Navy personnel data and defence contractors, and was issued alongside coordinated statements from twelve allied governments — the broadest joint attribution against China at that time.\n\nThe group has remained active under sustained pressure, with continued campaigns against Japanese organisations and their overseas subsidiaries, and against telecommunications and government targets across Asia.",
    "attribution": {
      "sponsor": "China",
      "service": "Ministry of State Security (MSS) — Tianjin State Security Bureau",
      "unit": "Huaying Haitai Science and Technology Development Co. (front company)",
      "confidence": "confirmed",
      "summary": "Zhu Hua and Zhang Shilong were indicted by the U.S. Department of Justice in December 2018. The indictment identifies them as members of APT10 acting in association with the Tianjin State Security Bureau, operating through the front company Huaying Haitai. The charges cover Operation Cloud Hopper against MSPs in at least twelve countries and a separate campaign against U.S. Navy personnel records. Twelve allied governments issued concurring statements.",
      "sources": [
        {
          "org": "U.S. Department of Justice",
          "title": "Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns",
          "url": "https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion",
          "date": "2018-12-20"
        },
        {
          "org": "PwC UK / BAE Systems",
          "title": "Operation Cloud Hopper",
          "url": "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf",
          "date": "2017-04-03"
        }
      ]
    },
    "motivations": [
      "espionage",
      "ip-theft"
    ],
    "targetSectors": [
      "Managed Service Providers",
      "Technology",
      "Government",
      "Defense",
      "Manufacturing",
      "Aerospace",
      "Healthcare",
      "Energy",
      "Telecommunications",
      "Pharmaceuticals"
    ],
    "targetCountries": [
      "Japan",
      "United States",
      "United Kingdom",
      "France",
      "India",
      "South Korea",
      "Canada",
      "Australia",
      "Norway",
      "Sweden"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "menuPass",
        "url": "https://attack.mitre.org/groups/G0045/",
        "correlation": "exact"
      },
      {
        "org": "crowdstrike",
        "name": "Stone Panda",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT10",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "BRONZE RIVERSIDE",
        "correlation": "exact"
      },
      {
        "org": "symantec",
        "name": "Cicada",
        "correlation": "exact"
      },
      {
        "org": "trendmicro",
        "name": "Chessmaster",
        "correlation": "partial",
        "note": "Trend Micro's campaign-specific designator"
      },
      {
        "org": "recordedfuture",
        "name": "RedApollo",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "APT10 / Tianjin State Security Bureau",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "CVNX",
        "correlation": "exact"
      },
      {
        "org": "proofpoint",
        "name": "TA429",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "PlugX",
        "type": "backdoor",
        "custom": false,
        "description": "Shared Chinese backdoor delivered via DLL side-loading; heavily used in Cloud Hopper intrusions.",
        "malpediaSlug": "win.plugx"
      },
      {
        "name": "QuasarRAT",
        "type": "backdoor",
        "custom": false,
        "description": "Open-source .NET RAT adopted in place of custom tooling to complicate attribution."
      },
      {
        "name": "RedLeaves",
        "type": "backdoor",
        "custom": true,
        "description": "Custom implant developed from the open-source Trochilus RAT, used for durable MSP access.",
        "malpediaSlug": "win.redleaves"
      },
      {
        "name": "ChChes",
        "type": "backdoor",
        "custom": true,
        "description": "Lightweight backdoor delivered by phishing, signed with stolen certificates.",
        "malpediaSlug": "win.chches"
      },
      {
        "name": "UPPERCUT / ANEL",
        "type": "backdoor",
        "custom": true,
        "description": "Backdoor used against Japanese targets, with C2 over HTTP and staged plugin loading."
      },
      {
        "name": "LODEINFO",
        "type": "backdoor",
        "custom": true,
        "description": "Implant used in continuing campaigns against Japanese media, government, and think tanks."
      }
    ],
    "techniques": [
      {
        "tCode": "T1199",
        "name": "Trusted Relationship",
        "tactic": "Initial Access",
        "note": "The Cloud Hopper model — MSP management channels into client networks"
      },
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1574.002",
        "name": "Hijack Execution Flow: DLL Side-Loading",
        "tactic": "Defense Evasion"
      },
      {
        "tCode": "T1078",
        "name": "Valid Accounts",
        "tactic": "Lateral Movement",
        "note": "Legitimate MSP administrative credentials for client access"
      },
      {
        "tCode": "T1021.001",
        "name": "Remote Services: Remote Desktop Protocol",
        "tactic": "Lateral Movement"
      },
      {
        "tCode": "T1003.003",
        "name": "OS Credential Dumping: NTDS",
        "tactic": "Credential Access"
      },
      {
        "tCode": "T1560.001",
        "name": "Archive Collected Data: Archive via Utility",
        "tactic": "Collection",
        "note": "WinRAR staging of stolen material with password protection"
      },
      {
        "tCode": "T1048.002",
        "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
        "tactic": "Exfiltration"
      },
      {
        "tCode": "T1553.002",
        "name": "Subvert Trust Controls: Code Signing",
        "tactic": "Defense Evasion",
        "note": "Malware signed with stolen certificates"
      },
      {
        "tCode": "T1090.002",
        "name": "Proxy: External Proxy",
        "tactic": "Command and Control"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2017-11882",
        "firstExploited": "2018-01-01",
        "usage": "Equation Editor overflow in phishing documents against Japanese government and academic targets.",
        "source": {
          "org": "Mandiant / FireEye",
          "title": "APT10 Targeting Japanese Corporations Using Updated TTPs",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/apt10-targeting-japanese-corporations-using-updated-ttps",
          "date": "2018-09-13"
        }
      },
      {
        "cveId": "CVE-2019-0604",
        "firstExploited": "2019-06-01",
        "usage": "SharePoint deserialisation exploited to deploy web shells at government and enterprise targets.",
        "source": {
          "org": "Symantec",
          "title": "Cicada: Chinese APT Group Widens Targeting",
          "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/cicada-apt10-japan-espionage",
          "date": "2020-11-17"
        }
      },
      {
        "cveId": "CVE-2021-26855",
        "firstExploited": "2021-03-01",
        "usage": "ProxyLogon adopted following disclosure for Exchange access at enterprise targets.",
        "source": {
          "org": "ESET",
          "title": "Exchange servers under siege from at least 10 APT groups",
          "url": "https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/",
          "date": "2021-03-10"
        }
      },
      {
        "cveId": "CVE-2018-13379",
        "firstExploited": "2020-06-01",
        "usage": "FortiOS SSL VPN traversal used to obtain credentials for access to MSP and enterprise perimeters.",
        "source": {
          "org": "Symantec",
          "title": "Cicada: Chinese APT Group Widens Targeting",
          "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/cicada-apt10-japan-espionage",
          "date": "2020-11-17"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "apt41",
        "type": "same-sponsor",
        "confidence": "high",
        "note": "Both MSS-linked contractor operations with overlapping tooling, including ShadowPad and PlugX lineage implants."
      },
      {
        "relatedActorId": "apt1",
        "type": "successor",
        "confidence": "moderate",
        "note": "Represents the post-2015 shift of PRC operations from PLA units to MSS provincial bureaus and contractors."
      },
      {
        "relatedActorId": "mustang-panda",
        "type": "shared-tooling",
        "confidence": "high",
        "note": "Shared PlugX lineage and DLL side-loading tradecraft."
      }
    ],
    "reports": [
      {
        "org": "PwC UK / BAE Systems",
        "title": "Operation Cloud Hopper: Exposing a systematic global campaign against MSPs",
        "url": "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf",
        "date": "2017-04-03"
      },
      {
        "org": "U.S. Department of Justice",
        "title": "Indictment: US v. Zhu Hua and Zhang Shilong (APT10 / Tianjin SSB)",
        "url": "https://www.justice.gov/opa/press-release/file/1121706/download",
        "date": "2018-12-20"
      },
      {
        "org": "Symantec",
        "title": "Cicada: Chinese APT Group Widens Targeting in Recent Espionage Activity",
        "url": "https://symantec-enterprise-blogs.security.com/threat-intelligence/cicada-apt10-japan-espionage",
        "date": "2020-11-17"
      }
    ],
    "campaigns": [
      {
        "id": "cloud-hopper",
        "actorId": "apt10",
        "name": "Operation Cloud Hopper",
        "date": "2016-01-01",
        "endDate": "2018-12-01",
        "significance": "landmark",
        "targetSectors": [
          "Managed Service Providers",
          "Technology",
          "Manufacturing",
          "Aerospace",
          "Energy",
          "Healthcare"
        ],
        "targetCountries": [
          "United States",
          "United Kingdom",
          "Japan",
          "France",
          "Canada",
          "Australia",
          "India",
          "Norway"
        ],
        "cveIds": [],
        "summary": "Systematic compromise of managed service providers to reach their clients through legitimate management connections. One MSP compromise yielded access to dozens or hundreds of downstream organisations over trusted administrative channels.",
        "sources": [
          {
            "org": "PwC UK / BAE Systems",
            "title": "Operation Cloud Hopper",
            "url": "https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf",
            "date": "2017-04-03"
          }
        ]
      }
    ],
    "flag": "🇨🇳",
    "profile": "/apt/apt10/"
  }
}