Loading story…
Researchers reported that APT10 conducted a long-running cyber-espionage campaign against Turkish organizations, with activity dating back to 2016 and discovery in early 2020. The intrusion reportedly began through exploitation of a public-facing web application, after which the attackers deployed China Chopper and JspSpy web shells, used legitimate Windows tools for reconnaissance, and expanded access with malware and utilities including PlugX, Cobalt Strike, QuasarRAT, hTran, QuarksPWdump, Mimikatz, PsExec, and WMI-based lateral movement techniques.
The campaign was described as affecting entities in sectors such as telecommunications and finance, with broader concern for government, defense, energy, and trade-linked organizations in Turkey. The reporting linked the operation to geopolitical interests around Eastern Mediterranean energy resources and Turkey’s regional posture, while a U.S. Justice Department case charging two Chinese hackers associated with the Ministry of State Security reinforced longstanding allegations tying APT10 to Chinese state-backed intrusion activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
In January 2020, Adeo identified a malicious campaign against Turkish organizations and allegedly attributed it to APT10. The report said the attackers gained initial access by exploiting a public-facing web application and then deployed webshells and post-exploitation tools.
Adeo's report states that the espionage campaign targeting Turkish organizations began in 2016. The activity was later attributed in the article to APT10 and involved sectors including telecommunications and finance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese state-linked hacking group tracked as **APT10** was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than **80%** of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as **Operation Cache Panda**, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly. After initial access, the attackers uploaded the **ASPXCSharp** web shell to control exposed servers, used **Impacket** to scan internal networks, and moved laterally with **Remote Service** creation and **WMI**. They then deployed a **Quasar RAT** variant and other .NET payloads through reflective in-memory loading using tooling associated with **Donut** and **SharpSploit**, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel **RDP** access for persistent interactive control and used the Chinese cloud file-sharing service **WenShuShu** to retrieve tools during the operation.
Aug 15, 2026
Operation **Cloud Hopper** was identified as a large-scale cyber espionage campaign that compromised managed service providers (MSPs) to gain access to both the providers and their downstream customer environments. Incident responders from **PwC** and **BAE Systems** said the activity was discovered in late 2016 and involved theft of intellectual property and other sensitive business information from organizations connected through trusted IT outsourcing relationships. The campaign was attributed with high confidence to **APT10**, based on overlaps with earlier operations including infrastructure and command-and-control patterns. Reporting linked the group to China, citing indicators such as `UTC+8` working patterns, domain registration timing, binary compile times, and victim targeting aligned with Chinese strategic interests, while noting that the operation marked a significant increase in the group’s scale and capability.
Aug 15, 2026
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026