Cloud Hopper

Cloud Hopper is a threat actor, also known as APT10, that has been involved in significant cyber espionage activities. This group executed a campaign named Operation Cloud Hopper, where they targeted managed IT service providers with the intention of gaining unauthorized access to their clients' networks. The campaign was characterized by sophisticated tactics and techniques, including the use of Nbtscan, a tool utilized to search for services across the IT estate and footprint endpoints of interest. The operation was first detailed in a report by PWC (PricewaterhouseCoopers), which shed light on the extent and severity of the attacks orchestrated by Cloud Hopper. The group's activities primarily revolved around leveraging the trust relationships between IT service providers and their clients. By infiltrating these providers, Cloud Hopper was able to hop from one client network to another, hence the name of the operation. APT10's Operation Cloud Hopper represents a serious threat to corporate security, especially for companies relying on managed IT service providers. The campaign highlights the need for robust cybersecurity measures, not just at the individual company level but also within third-party service providers. As such, organizations are advised to conduct thorough risk assessments of their supply chains and implement stringent controls to mitigate the risk of similar threats in the future.