# Apt10 Stone Panda

Adversary-emulation profile for APT10 (G0045 / Stone Panda / menuPass / POTASSIUM / Red...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt10-stone-panda -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt10-stone-panda -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt10-stone-panda -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt10-stone-panda -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT10 (G0045 / Stone Panda / menuPass / POTASSIUM / Red Apollo / CVNX), China's MSS Tianjin State Security Bureau cyber-espionage actor.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT10 (Stone Panda, menuPass, POTASSIUM, Red Apollo), Adversary Emulation Profile

APT10 (MITRE ATT&CK **G0045**) is a long-running Chinese cyber-espionage group active since at least 2006, attributed to China's Ministry of State Security (MSS) **Tianjin State Security Bureau**. Individual members have been identified as working for the Huaying Haitai Science and Technology Development Company. APT10 is best known for **Operation Cloud Hopper**, the systematic, large-scale compromise of managed IT service providers (MSPs) to pivot into hundreds of downstream client organizations worldwide, a paradigm-defining supply-chain attack. The group's toolkit spans custom implants (PlugX, RedLeaves, ChChes, UPPERCUT/ANEL, SodaMaster, Ecipekac), public frameworks (QuasarRAT, Cobalt Strike, Mimikatz, PsExec), and heavy reliance on DLL side-loading for evasion. Targeting is broad: healthcare, defense, aerospace, government, telecom, maritime, finance, and biotechnology, with a persistent emphasis on Japanese organizations and Western MSPs.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt10-stone-panda/SKILL.md