Initial Access
2 techniques·derived
The Cloud Hopper model — MSP management channels into client networks.
APT10
Operation Cloud Hopper — compromised managed service providers to reach their clients' networks, turning outsourced IT into a single point of failure.
ATTRIBUTED TOChina › Ministry of State Security (MSS) — Tianjin State Security Bureau › Huaying Haitai Science and Technology Development Co. (front company)
- Active
- 2006–present
- Motivation
- Espionage, IP Theft
- Aliases
- 10
- Exploited CVEs
- 4
- ATT&CK techniques
- 10
- Cited sources
- 9
Overview
APT10 pioneered the managed service provider as an attack vector, and in doing so changed how defenders think about third-party risk.
Operation Cloud Hopper, documented by PwC and BAE Systems in 2017, described the group compromising MSPs and then moving through the legitimate management connections those providers maintain into client networks. The economics are brutally favourable: one MSP compromise yields access to dozens or hundreds of downstream organisations, and the intrusion arrives over trusted, expected administrative channels that security teams are unlikely to question.
The December 2018 U.S. indictment of Zhu Hua and Zhang Shilong tied the group to the Tianjin State Security Bureau through the front company Huaying Haitai Science and Technology Development Co. It also charged a separate long-running campaign against U.S. Navy personnel data and defence contractors, and was issued alongside coordinated statements from twelve allied governments — the broadest joint attribution against China at that time.
The group has remained active under sustained pressure, with continued campaigns against Japanese organisations and their overseas subsidiaries, and against telecommunications and government targets across Asia.
Attribution
Down to the named unit where public evidence supports it.
ChinaMinistry of State Security (MSS) — Tianjin State Security BureauHuaying Haitai Science and Technology Development Co. (front company)Confirmed
Zhu Hua and Zhang Shilong were indicted by the U.S. Department of Justice in December 2018. The indictment identifies them as members of APT10 acting in association with the Tianjin State Security Bureau, operating through the front company Huaying Haitai. The charges cover Operation Cloud Hopper against MSPs in at least twelve countries and a separate campaign against U.S. Navy personnel records. Twelve allied governments issued concurring statements.
Attributing sources
Cross-vendor naming crosswalk
10 designators across 10 organisations.
1 designator is marked partial — the vendor's cluster overlaps this group but is not synonymous with it. Treating a partial correlation as an equivalence is the most common source of attribution error when pivoting between vendor reports.
MITRE ATT&CK
index ↗- menuPass
Assigns a stable Gxxxx group ID and adopts the most widely used public name. Deliberately conservative — MITRE merges clusters only when public reporting supports it.
CrowdStrike
index ↗- Stone Panda
Animal denotes attributed nation-state or motive; the adjective distinguishes clusters. The original public adversary taxonomy, in use since 2012.
Mandiant / Google Threat Intelligence
index ↗- APT10
APTxx for state-nexus espionage, FINxx for financially motivated, UNCxxxx ('uncategorized') for clusters not yet graduated to a named group. Many UNC numbers are later merged into an APT/FIN designator.
Secureworks CTU
index ↗- BRONZE RIVERSIDE
Metal prefix encodes attributed origin, paired with an arbitrary uppercase codeword.
Recorded Future Insikt Group
index ↗- RedApollo
Colour prefix encodes attributed origin (RedXxxx = China, BlueXxxx = Russia). TAG-## ('Threat Activity Group') is a provisional designator for clusters pending attribution.
Kaspersky GReAT
index ↗- CVNX
Descriptive names, often coined from a distinctive string or artifact in the toolset.
Trend Micro
index ↗- ChessmasterpartialTrend Micro's campaign-specific designator
'Earth <name>' for many state-nexus groups; older clusters retain descriptive names such as Pawn Storm.
Symantec (Broadcom)
index ↗- Cicada
Insect, animal, and plant names assigned in the order clusters were first identified.
CISA / NSA / FBI
index ↗- APT10 / Tianjin State Security Bureau
U.S. government advisories generally reference groups by the most common industry name plus the attributed unit. Joint advisories are the authoritative source for unit-level attribution.
Targeting
Target sectors
Target geography
JapanUnited StatesUnited KingdomFranceIndiaSouth KoreaCanadaAustraliaNorwaySweden
Tools & malware
Custom tooling is a strong clustering signal; shared and commodity tooling is not.
Custom / bespoke
RedLeavesbackdoor
Custom implant developed from the open-source Trochilus RAT, used for durable MSP access.
Malpedia ↗ChChesbackdoor
Lightweight backdoor delivered by phishing, signed with stolen certificates.
Malpedia ↗UPPERCUT / ANELbackdoor
Backdoor used against Japanese targets, with C2 over HTTP and staged plugin loading.
LODEINFObackdoor
Implant used in continuing campaigns against Japanese media, government, and think tanks.
Shared, commodity & living-off-the-land
PlugXbackdoor
Shared Chinese backdoor delivered via DLL side-loading; heavily used in Cloud Hopper intrusions.
Malpedia ↗QuasarRATbackdoor
Open-source .NET RAT adopted in place of custom tooling to complicate attribution.
Exploited vulnerabilities
Filtered on the date this actor was first reported exploiting the flaw — not the CVE's publication date.
| CVE | Product | Usage by APT10 | ||
|---|---|---|---|---|
| CVE-2021-26855KEVransomware | 9.8 | Microsoft Exchange ServerMicrosoft | 1 Mar 2021 | ProxyLogon adopted following disclosure for Exchange access at enterprise targets.SRCESET ↗ |
| CVE-2018-13379KEVransomware | 9.8 | FortiOS SSL VPNFortinet | 1 Jun 2020 | FortiOS SSL VPN traversal used to obtain credentials for access to MSP and enterprise perimeters.SRCSymantec ↗ |
| CVE-2019-0604KEVransomware | 9.8 | Microsoft SharePointMicrosoft | 1 Jun 2019 | SharePoint deserialisation exploited to deploy web shells at government and enterprise targets.SRCSymantec ↗ |
| CVE-2017-11882KEVransomware | 7.8 | Microsoft OfficeMicrosoft | 1 Jan 2018 | Equation Editor overflow in phishing documents against Japanese government and academic targets.SRCMandiant / FireEye ↗ |
Actors sharing exploited CVEs
Kill chain
How this actor moves through an intrusion, stage by stage, titled by ATT&CK tactic. Read left to right.
7 stages · 10 techniques
01 02 Defense Evasion
2 techniques·derived
Malware signed with stolen certificates.
03 Credential Access
1 technique·derived
NTDS.
04 Lateral Movement
2 techniques·derived
Legitimate MSP administrative credentials for client access.
05 Collection
1 technique·derived
WinRAR staging of stolen material with password protection.
06 Command and Control
1 technique·derived
External Proxy.
07 Exfiltration
1 technique·derived
Exfiltration Over Asymmetric Encrypted Non-C2 Protocol.
Scroll horizontally · characteristic chain across documented operations, not a single incident
MITRE ATT&CK techniques
Grouped in kill-chain order.
10 techniques across 7 tactics · 4 with actor-specific notes
Initial Access
2- T1199Trusted Relationship
The Cloud Hopper model — MSP management channels into client networks
- T1566.001Phishing: Spearphishing Attachment
Defense Evasion
2- T1574.002Hijack Execution Flow: DLL Side-Loading
- T1553.002Subvert Trust Controls: Code Signing
Malware signed with stolen certificates
Credential Access
1Lateral Movement
2- T1078Valid Accounts
Legitimate MSP administrative credentials for client access
- T1021.001Remote Services: Remote Desktop Protocol
Collection
1- T1560.001Archive Collected Data: Archive via Utility
WinRAR staging of stolen material with password protection
Command and Control
1Campaign timeline
- landmark
Operation Cloud Hopper
Systematic compromise of managed service providers to reach their clients through legitimate management connections. One MSP compromise yielded access to dozens or hundreds of downstream organisations over trusted administrative channels.
Managed Service ProvidersTechnologyManufacturingAerospace
Known to work with
Relationship type and confidence stated explicitly — 'related' without qualification is not an assessment.
APT41🇨🇳 China
Same sponsorHigh confidence
Both MSS-linked contractor operations with overlapping tooling, including ShadowPad and PlugX lineage implants.
APT1🇨🇳 China
Successor / rebrandModerate confidence
Represents the post-2015 shift of PRC operations from PLA units to MSS provincial bureaus and contractors.
Mustang Panda🇨🇳 China
Shared toolingHigh confidence
Shared PlugX lineage and DLL side-loading tradecraft.
Primary-source reporting
Curated links to the reports that established what is known about this group.