Loading story…
A Chinese state-linked hacking group tracked as APT10 was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than 80% of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as Operation Cache Panda, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly.
After initial access, the attackers uploaded the ASPXCSharp web shell to control exposed servers, used Impacket to scan internal networks, and moved laterally with Remote Service creation and WMI. They then deployed a Quasar RAT variant and other .NET payloads through reflective in-memory loading using tooling associated with Donut and SharpSploit, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel RDP access for persistent interactive control and used the Chinese cloud file-sharing service WenShuShu to retrieve tools during the operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CyCraft reported that one of its customers was compromised in February 2022, which helped investigators determine that what appeared to be separate attack waves were actually one prolonged campaign. The investigation linked the activity to the broader Operation Cache Panda intrusion set.
CyCraft said the intrusion campaign against Taiwanese financial organizations began at the end of November 2021. The attackers exploited a vulnerability in the web management interface of a widely used securities/security software product to gain initial access.
Symantec reported that a China-linked group tracked as Antlion remained inside an unnamed Taiwanese financial organization for close to 250 days, from December 2020 to August 2021, as part of an espionage campaign. The intrusion involved the custom xPack backdoor, which enabled command execution, malware delivery, and data staging for exfiltration.
CyCraft assessed that the campaign targeting Taiwan's financial sector was conducted by APT10, a Chinese government-affiliated cyber-espionage group. Reporting described the operation as a supply-chain style intrusion affecting multiple enterprises through a widely deployed software product.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
medium.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A China-linked espionage group tracked as **Cicada**/**APT10** exploited Microsoft’s **Zerologon** flaw, `CVE-2020-1472`, in a long-running campaign against major Japanese companies and some overseas subsidiaries, including entities in the United States. Researchers said the attackers used the bug to compromise domain controllers, steal domain credentials, and effectively seize control of **Active Directory** environments, enabling credential theft, network reconnaissance, data exfiltration, and persistent access across victim networks. The operation combined public exploit activity around Zerologon with a broader post-compromise toolkit that included **QuasarRAT**, the newly observed **Backdoor.Hartip**, DLL side-loading, and administrative utilities such as **WMIExec**, **Certutil**, and **PowerShell**. Separate honeypot telemetry also showed in-the-wild Zerologon exploitation against exposed internet systems, underscoring how quickly the vulnerability moved from disclosure to active abuse while APT10 leveraged distinctive tradecraft such as `CppHostCLR`-based .NET loader execution and **ConfuserEx** obfuscation.
Aug 15, 2026
Researchers reported that **APT10** conducted a long-running cyber-espionage campaign against Turkish organizations, with activity dating back to 2016 and discovery in early 2020. The intrusion reportedly began through exploitation of a public-facing web application, after which the attackers deployed **China Chopper** and **JspSpy** web shells, used legitimate Windows tools for reconnaissance, and expanded access with malware and utilities including **PlugX**, **Cobalt Strike**, **QuasarRAT**, **hTran**, **QuarksPWdump**, **Mimikatz**, **PsExec**, and **WMI-based** lateral movement techniques. The campaign was described as affecting entities in sectors such as **telecommunications** and **finance**, with broader concern for **government, defense, energy, and trade-linked organizations** in Turkey. The reporting linked the operation to geopolitical interests around Eastern Mediterranean energy resources and Turkey’s regional posture, while a U.S. Justice Department case charging two Chinese hackers associated with the **Ministry of State Security** reinforced longstanding allegations tying APT10 to Chinese state-backed intrusion activity.
Aug 14, 2026
Multiple reports linked the Chinese espionage group **APT10**—also tracked as **MenuPass** and **Cicada**—to long-running intrusions that used **Poison Ivy**, **ChChes**, and **Sodamaster** against governments, NGOs, telecoms, legal, pharmaceutical, academic, media, and managed service provider targets across Asia, Europe, and North America. FireEye previously clustered Poison Ivy activity into the `menuPass`, `admin@338`, and `th3bug` campaigns, while Palo Alto documented `th3bug` watering-hole attacks that delivered Poison Ivy through compromised websites and infrastructure tied together by shared command-and-control patterns. Trend Micro also reported that the Japan-focused **ChessMaster** espionage campaign overlapped with APT10 in targeting, malware packaging, infrastructure, and tradecraft, and Symantec later said Cicada/APT10 expanded operations through prolonged intrusions, in some cases beginning with Microsoft Exchange access and persisting for months. Separate attribution research traced historical domain registrations, phishing metadata, social media accounts, and company records to alleged Tianjin-based operators including **Gao Qiang**, **Zhang Shilong**, and **An Zhiqiang**. Investigators said APT10-linked infrastructure such as `chromeenter[.]com`, `js001.3322[.]org`, `xiaohong[.]org`, and related domains connected to Tianjin email addresses, phone numbers, hostnames, and online personas including `fisherxp`, `baobeilong`, and `@gbaike`. The reporting argued that these overlaps tied real-world individuals and a Tianjin technology company to infrastructure associated with earlier **Cloud Hopper** and FireEye-tracked APT10 activity, strengthening claims that the group’s malware campaigns and domain operations were run by operators based in Tianjin, China.
Aug 15, 2026