APT10

APT10, also known as Menupass, is a sophisticated threat actor believed to operate on behalf of the Chinese Ministry of State Security (MSS). This group has been associated with numerous cyber espionage campaigns targeting various sectors globally. Recent analysis suggests a link between APT10 and other threat actors like Earth Tengshe and Earth Kasha, which are also suspected to have connections with China. The evidence for these connections includes similarities in tools, techniques, procedures (TTPs), and operator resources used by these groups. Several campaigns, such as the A41APT Campaign and LODEINFO campaign, have been analyzed and found to exhibit overlap with APT10 operations. The A41APT Campaign, attributed to Earth Tengshe, and the LODEINFO campaign, linked to Earth Kasha, both demonstrate tactics and methods consistent with APT10's modus operandi. For instance, the use of ANEL, a 32-bit HTTP-based backdoor observed since around 2017 and known as one of the primary backdoors used by APT10 until around 2018, was noted in these recent campaigns. This reuse supports the connection between APT10 and the current activities of Earth Kasha. Despite these correlations, it's important to note that APT10 and Earth Kasha are currently viewed as separate entities, albeit with potential links. Both groups have been observed using obfuscation techniques popular among China-nexus adversaries, including APT10 and Twisted Panda. In conclusion, while the direct relationship between APT10, Earth Tengshe, and Earth Kasha remains under investigation, their shared tactics, techniques, and resources suggest a possible common origin or collaboration.