Loading threat actor…
APT10, also known as menuPass, Stone Panda, Red Apollo, Cicada, Potassium, Purple Typhoon, and Bronze Riverside, is a China-based cyberespionage threat group conducting international network intrusions and data theft. A prominent feature of its operations is the compromise of managed service providers (MSPs) to access their customers' environments. The group abuses valid accounts shared between providers and clients to move across organizational boundaries. Its targeting spans Asia, North America, Europe, and other regions, with Japan and the United States prominent among its targets. In December 2018, the United States Department of Justice charged two Chinese members of APT10 in connection with its operations. APT10 obtains initial access through spearphishing attachments, including malicious Microsoft Office documents and executables disguised as documents, and has exploited Pulse Secure VPN vulnerabilities to hijack sessions. Its malware includes PlugX and UPPERCUT. It executes payloads through Office macros, command shells, reverse shells, modified WMI execution scripts, and Windows Task Scheduler. Post-compromise activity includes internal network enumeration, credential dumping with Ntdsutil, and use or modification of Impacket, Mimikatz, and pwdump. The group moves laterally through RDP and compromised accounts and has used tools exploiting Zerologon (CVE-2020-1472). It conceals malicious content through Base64 encoding, single-byte XOR obfuscation, misleading file extensions, and abuse of legitimate Windows utilities to decode payloads. Collected files are compressed with TAR or RAR before exfiltration.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
49 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
42 malware families attributed to this actor across reporting.
37 additional families tracked in Mallory.
12 CVEs this actor has used in observed campaigns. 12 of them exploited in the wild.
Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers. Earth Lusca, FIN7, menuPass, MuddyWater, and Wizard Spider are also associated with its exploitation or attempted exploitation.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
The title of the lure was “2016年台灣總統選舉觀戰團 行程20160105.xls” which translates to “2016 Taiwan president election watching group schedule”. Once the spreadsheet is opened, CVE-2012-0158 is exploited and a file called 6EC5.tmp is dropped in the %TEMP% folder.
Vulnerabilities Exploited : Eternalromance Exploit (CVE-2017-0143). Later in early 2018, the APT10 was seen again carrying out a cyber attack against the systems used in the Pyeongchang, South Korea, WinterOlympics 2018 (using EternalRomance SMB exploit).
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
7 more CVEs tied to this actor tracked in Mallory.
565 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT10 is cited as a historical example of attackers targeting managed service providers to access their customers' data worldwide. The article does not attribute quantum-related collection or attacks to APT10.
Chinese state-linked actor cited for campaigns compromising healthcare and biotechnology organizations.
Listed as an actor associated with the detection's technique annotation; no specific menuPass campaign or activity is described.
Annotation-only mention; no actor-specific operation or behavior is described.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.