menuPass

APT10, also known as menuPass, is a long-running China-nexus cyber-espionage threat actor publicly linked by the United States government to China’s Ministry of State Security, specifically the Tianjin State Security Bureau, and associated contractor activity. It is widely tracked under numerous aliases including Stone Panda, Cicada, Red Apollo, CVNX, POTASSIUM, HOGFISH, BRONZE RIVERSIDE, Purple Typhoon, and others. The group has conducted strategic espionage for well over a decade, with activity reported since at least the late 2000s. APT10 is best known for compromising managed service providers, IT service providers, and other trusted intermediaries in order to gain downstream access to customer environments at scale, a pattern exemplified by Operation Cloud Hopper. Beyond service-provider intrusions, the group has targeted government, defense, aerospace, healthcare, finance, maritime, biotechnology, energy, telecommunications, manufacturing, mining, legal, religious, NGO, pharmaceutical, and advanced technology organizations across Asia, Europe, and North America. Its objectives are consistently aligned with intelligence collection, theft of intellectual property, and acquisition of sensitive government and commercial information. The group commonly gains initial access through spearphishing attachments, malicious documents, and other user-execution lures, and has also been associated with exploitation of public-facing enterprise systems. APT10 frequently abuses trusted relationships and valid accounts after compromise. Observed tradecraft includes extensive use of PowerShell and Windows command shell, WMI, scheduled tasks, InstallUtil, DLL sideloading, credential dumping, Active Directory enumeration, remote services, and data staging prior to exfiltration. The actor has used native administrative and dual-use tools for reconnaissance and lateral movement, including exporting Active Directory data with csvde and using utilities such as certutil to decode staged payloads. Malware and tooling associated with APT10 across reporting include ANEL and related loaders, LODEINFO, NOOPDOOR, NOOPLDR, SOGU, HAYMAKER, SNUGRIDE, BUGJUICE, RedLeaves, PlugX, ChChes, SodaMaster, customized Quasar RAT variants, and other loaders and backdoors. The group has also demonstrated reflective and in-memory execution techniques, anti-forensics measures, and stealth-focused persistence. Some tooling overlaps with broader Chinese intrusion ecosystems, so malware presence alone is not sufficient for attribution. Reporting also describes a broader APT10 umbrella that includes related or descendant activity clusters. MirrorFace, also tracked as Earth Kasha, is assessed as a China-aligned subgroup or affiliated cluster within that umbrella and has focused heavily on Japanese targets while using ANEL, NOOPDOOR, customized AsyncRAT, DLL sideloading, and stealthy post-compromise tradecraft. More recent APT10-linked or umbrella-associated activity has shown continued adaptation, including abuse of cloud services, OAuth tokens, and legitimate remote-access or development services. Overall, APT10 remains one of the most significant Chinese espionage actors due to its longevity, global reach, service-provider targeting model, and sustained focus on strategic intelligence collection.