APT10 (Stone Panda, menuPass, POTASSIUM, Red Apollo), Adversary Emulation Profile

APT10 (MITRE ATT&CK G0045) is a long-running Chinese cyber-espionage group active since at least 2006, attributed to China's Ministry of State Security (MSS) Tianjin State Security Bureau. Individual members have been identified as working for the Huaying Haitai Science and Technology Development Company. APT10 is best known for Operation Cloud Hopper, the systematic, large-scale compromise of managed IT service providers (MSPs) to pivot into hundreds of downstream client organizations worldwide, a paradigm-defining supply-chain attack. The group's toolkit spans custom implants (PlugX, RedLeaves, ChChes, UPPERCUT/ANEL, SodaMaster, Ecipekac), public frameworks (QuasarRAT, Cobalt Strike, Mimikatz, PsExec), and heavy reliance on DLL side-loading for evasion. Targeting is broad: healthcare, defense, aerospace, government, telecom, maritime, finance, and biotechnology, with a persistent emphasis on Japanese organizations and Western MSPs.

Attribution & motivation