| Formation | c. 2003–2005[1] |
|---|---|
| Type | Advanced persistent threat |
| Purpose | Cyberespionage,cyberwarfare |
Region | China |
| Methods | Zero-days,Phishing,backdoor (computing),RAT,Keylogging |
Official language | Chinese |
Parent organization | Tianjin State Security Bureau of theMinistry of State Security |
Formerly called | APT10 Stone Panda MenuPass RedLeaves CVNX POTASSIUM |
Red Apollo (also known asAPT 10 byMandiant,MenuPass byFireeye,Stone Panda byCrowdstrike, andPOTASSIUM byMicrosoft)[1][2] is aChinese state-sponsoredcyberespionage group which has operated since 2006. In a 2018 indictment, theUnited States Department of Justice attributed the group to theTianjin State Security Bureau of theMinistry of State Security.[3]
The team was designated anadvanced persistent threat by Fireeye, who reported that they target aerospace, engineering, and telecom firms and any government that they believe is a rival ofChina.
Fireeye stated that they could be targeting intellectual property from educational institutions such as a Japanese university and is likely to expand operations into the education sector in the jurisdictions of nations that are allied with theUnited States.[4] Fireeye claimed that they were tracked since 2009, however because of the low-threat nature they had posed, they were not a priority. Fireeye now describes the group as "a threat to organizations worldwide."[4]
The group directly targets managed information technology service providers (MSPs) usingRAT. The general role of an MSP is to help manage a company's computer network. MSPs were often compromised by Poison Ivy, FakeMicrosoft, PlugX, ArtIEF,Graftor, and ChChes, through the use ofspear-phishing emails.[5]
Operation Cloud Hopper was an extensive attack and theft of information in 2017 directed at MSPs in the United Kingdom (U.K.), United States (U.S.), Japan, Canada, Brazil, France, Switzerland, Norway, Finland, Sweden, South Africa, India, Thailand, South Korea and Australia. The group used MSP's as intermediaries to acquire assets and trade secrets from MSP-client engineering, industrial manufacturing, retail, energy, pharmaceuticals, telecommunications, and government agencies.
Operation Cloud Hopper used over 70 variants of backdoors,malware andtrojans. These were delivered through spear-phishing emails. The attacks scheduled tasks or leveraged services/utilities to persist inMicrosoft Windows systems even if the computer system was rebooted. It installed malware and hacking tools to access systems and steal data.[5]
Hackers accessed records relating to 130,000US Navy personnel (out of 330,000).[6] Under these actions the Navy decided to coordinate withHewlett Packard Enterprise Services, despite warnings being given prior to the breach.[7] All affected sailors were required to be notified.
A 2018 Indictment showed evidence that CVNX was not the name of the group, but was the alias of one of two hackers. Both used four aliases each to make it appear as if more than five hackers had attacked.
In April 2019 APT10 targeted government and private organizations in thePhilippines.[8]
In 2020 Symantec implicated Red Apollo in a series of attacks on targets in Japan.[9]
In March 2021, they targetedBharat Biotech and theSerum Institute of India (SII), the world's largest vaccine maker's intellectual property forexfiltration.[10]
| Organization |  | |
|---|---|---|
| Ministers | ||
| Major international operations | ||
| Notable works | ||
| Activities by country | ||