APT10

APT10, also known as the Menupass Team, is a threat actor believed to operate on behalf of the Chinese Ministry of State Security (MSS). The group has been active since 2009 and is suspected to be based in Tianjin, China, according to research by IntrusionTruth in 2018. APT10 has primarily targeted sectors such as construction and engineering, aerospace, telecom firms, and governments in the United States, Europe, and Japan. The tools and techniques used by this group are consistent with several Chinese threat actors, indicating a potential connection or shared resources. In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers carried out by APT10. This multi-wave attack focused on obtaining data of specific, high-value targets and resulted in a complete takeover of the network. The Remote Access Trojan (RAT) used in these attacks has been associated with various Chinese threat actors, including APT10, demonstrating its ability to take total control over a machine. In Operation Cloud Hopper, APT10 utilized Nbtscan to search for services of interest across IT estates and footprint endpoints of interest. APT10 has demonstrated significant capability and flexibility, being conflated with other MSS-linked intrusion activities such as Mustang Panda, Witchetty, and MirrorFace. It has also been linked to various campaigns against organizations in Japan, Middle East, and Africa. New tools unique to APT10 have been identified in recent intrusions, showing the group's continuous development and adaptation. Furthermore, APT10, also known as Stone Panda and MenuPass, is reported to have developed Trochilus, another powerful tool in their cyber arsenal.