Loading story…
Operation Cloud Hopper was identified as a large-scale cyber espionage campaign that compromised managed service providers (MSPs) to gain access to both the providers and their downstream customer environments. Incident responders from PwC and BAE Systems said the activity was discovered in late 2016 and involved theft of intellectual property and other sensitive business information from organizations connected through trusted IT outsourcing relationships.
The campaign was attributed with high confidence to APT10, based on overlaps with earlier operations including infrastructure and command-and-control patterns. Reporting linked the group to China, citing indicators such as UTC+8 working patterns, domain registration timing, binary compile times, and victim targeting aligned with Chinese strategic interests, while noting that the operation marked a significant increase in the group’s scale and capability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The campaign targeted managed IT service providers to steal the providers' sensitive data and gain access to the networks and data of their customers worldwide, potentially reaching thousands of networks through a small number of MSP compromises.
In late 2016, PwC and BAE Systems began assisting victims of a newly identified global cyber espionage campaign later named Operation Cloud Hopper.
PwC and BAE's Cloud Hopper assessment said APT10 had significantly increased its scale and capability since early 2016, marking an escalation in the group's operational reach.
A federal grand jury in the Southern District of New York indicted Zhu Hua and Zhang Shilong on charges including conspiracy to commit computer intrusions, wire fraud, and aggravated identity theft. The indictment identified them as APT10 members linked to China's Ministry of State Security and alleged a global intrusion campaign affecting MSPs, technology firms, government agencies, and more than 100,000 U.S. Navy personnel records.
The assessment concluded APT10 was highly likely to be China-based, based on indicators including compile times, domain registration times, UTC+8 working patterns, and targeting aligned with China's strategic interests.
PwC and BAE Systems assessed that Operation Cloud Hopper was almost certainly conducted by APT10, citing overlaps between Cloud Hopper infrastructure and command-and-control domains tied to the group's earlier operations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
darknetdiaries.com
Open sourcefbi.gov
Open sourceintrusiontruth.wordpress.com
Open sourcepwc.co.uk
Open sourcepwc.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **APT10** conducted a long-running cyber-espionage campaign against Turkish organizations, with activity dating back to 2016 and discovery in early 2020. The intrusion reportedly began through exploitation of a public-facing web application, after which the attackers deployed **China Chopper** and **JspSpy** web shells, used legitimate Windows tools for reconnaissance, and expanded access with malware and utilities including **PlugX**, **Cobalt Strike**, **QuasarRAT**, **hTran**, **QuarksPWdump**, **Mimikatz**, **PsExec**, and **WMI-based** lateral movement techniques. The campaign was described as affecting entities in sectors such as **telecommunications** and **finance**, with broader concern for **government, defense, energy, and trade-linked organizations** in Turkey. The reporting linked the operation to geopolitical interests around Eastern Mediterranean energy resources and Turkey’s regional posture, while a U.S. Justice Department case charging two Chinese hackers associated with the **Ministry of State Security** reinforced longstanding allegations tying APT10 to Chinese state-backed intrusion activity.
Aug 14, 2026
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026
A Chinese state-linked hacking group tracked as **APT10** was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than **80%** of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as **Operation Cache Panda**, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly. After initial access, the attackers uploaded the **ASPXCSharp** web shell to control exposed servers, used **Impacket** to scan internal networks, and moved laterally with **Remote Service** creation and **WMI**. They then deployed a **Quasar RAT** variant and other .NET payloads through reflective in-memory loading using tooling associated with **Donut** and **SharpSploit**, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel **RDP** access for persistent interactive control and used the Chinese cloud file-sharing service **WenShuShu** to retrieve tools during the operation.
Aug 15, 2026