Threat Report:
APT10
July 12, 2019

Table of Contents
1

EXECUTIVE SUMMARY ..............................................................................................32

THREAT ACTOR GROUP “APT10”................................................................................. 4

3

TOOLSETS ...................................................................................................................5

4

MITRE ATT&CK MATRIX ............................................................................................85

CAMPAIGNS ................................................................................................................9
5.1
Menu Pass............................................................................................................9
5.2
Cloud Hopper.......................................................................................................9
5.3
Chess Master .......................................................................................................9
5.4
White Fly............................................................................................................. 10
5.5
Hogfish Redleaves (New Battle)...................................................................... 11
5.6
Trade Secret ...................................................................................................... 11
5.7Soft Cell .............................................................................................................. 12
5.8
Others ................................................................................................................. 15

6

APT10’S NETWORK BEHAVIOR ................................................................................... 16

7

IOCs ............................................................................................................................ 17

Table of Figures
Figure 1 Utilities used by APT10 .........................................................................................5
Figure 2 Malware families used by APT10 ..........................................................................6
Figure 3 Open Source tools used by APT10.......................................................................7
Figure 4 Most common TTPs used by APT10 ....................................................................8
Figure 5 Process view ....................................................................................................... 14
Figure 6 High-level view of infrastructure used in operation Cloud Hopper in 2016 ........ 16© Cysiv LLC, 2019. All rights reserved.
2

1 EXECUTIVE SUMMARY
APT10 is a highly sophisticated advanced persistent threat (APT) group that has been
active since at least 2006. APT10 is believed to be a China-based actor and has
conducted several cyber espionage operations on several different organizations acrossdifferent industries including Education/Research, Cloud Service Providers, Defense,
Government, Healthcare, Telecommunications, Managed Service Providers (MSPs),
Manufacturing, Hospitality, Aerospace and Mining. The primary intent of APT10 isstealing strategic information, such as trade secrets and intellectual propery, to achieve
China’s national security objectives.
This threat actor has used various malware toolsets to drive its cyber espionage
operations. One of the first malware families used by APT10 was PoisionIvy RAT, which
was distributed using a spear phishing attack to infect Defense organizations, especiallythose in the United States. Another commonly used backdoor by APT10 is PlugX.
APT10 has used this backdoor to target several government agencies around the world
to steal the sensitive data and send them to C&C servers. APT10 constantly checks the
security research community and whenever they discover their backdoors have been
open sourced, they switch their toolset to new ones. This group is known to use large
interconnected dynamic domains for its C&C infrastructure, which makes the detectionof infrastructure hard.
This threat report provides an overview of APT10 including its toolset and its most wellknown operations.
Protection Provided by Cysiv:
The following Cysiv advanced managed security services provide protection from
APT10:• 24x7 monitoring and management provides organizations with real time alerts
and quick isolation and remediation to contain a threat during the early stages ofan attack to prevent a compromise, data loss or breach.
• User Protection Service: The anti-malware module that’s deployed as part ofthis service constantly monitors abnormal activities in the following OS locations
to detect any malicious behavior:- Master Boot Record (MBR)- Files- Registry entries- Kernel code patches- Operating system service hooks- File streams- Drivers- Ports© Cysiv LLC, 2019. All rights reserved.
3

•

•

- Processes- Services
Advanced Threat Detection Service: Network security appliances deployed
and monitored as part of this service detect phishing attacks/attachments, andare able to identify C&C communication over any port, and over 100 protocols.
These appliances also provide custom sandboxing, which can be used todetonate any suspicious files and executables to help prevent a breach.
Hybrid Cloud Security Service: Anti-malware provides protection from APT10
malware toolsets, and application control detects and optionally prevents theexecution of unknown binaries, depending on how it’s configured (detect mode or
block mode).

2 THREAT ACTOR GROUP “APT10”
APT10 is an advanced persistent threat group that many industry experts believe isfrom China that has been active since approximately 2006. They have been on theradar of different security companies, and are known by different code names: APT10(FireEye), Red Apollo (PWC), CVNX (BAE Systems), Stone Panda (CrowdStrike),
MenuPass (Trend Micro), Happyyongzi, POTASSIUM, DUSTSTORM, HOGFISH,
CLOUDHOPPER. For the purposes of this report, FireEye’s naming has been used as
it was the security company that first introduced this threat actor publicly, and as such
most people know this APT by “APT10”.
According to US officials, the primary purpose of many of the group’s campaigns is tosteal trade secrets and intellectual property that the Chinese government then passes tolocal Chinese companies, helping create unfair advantage for local firms on the global
market.
During the years of operations, the threat actor targeted several organizations in several
different industries. The primary target industries of this APT are Education/Research,
Cloud Service Providers, Defense, Government, Healthcare, Telecommunications,Managed Service Providers (MSPs), Manufacturing, Hospitality, Aerospace and Mining.
The targets of this group have included United States, Australia, Canada, Japan, New
Zealand, Germany, India, South Africa, South Korea, Sweden, France, Finland, United
Kingdom, Brazil, Thailand, Switzerland and Norway.

© Cysiv LLC, 2019. All rights reserved.
4

The most common initial attack vector used by APT10 is spear phishing, in which theactor usually leveraged .lnk file within archives. In addition to this method, this APT has
used another method in which it is infecting its victims through global/managed service
providers (MSPs). Since the MSPs have significant access to their clients’ network,
APT10 starts its attack by compromising the MSP’s network to move laterally into the
network of the MSP’s clients. The actor also can take advantage of network traffic
between the MSP’s client and the MSP itself, to exfiltrate data stealthily. This is because
network traffic between the MSP’s client and MSP is usually considered to be benign by
the client’s security team.

3 TOOLSETSAPT10 constantly creates, maintains and updates different types of malware andtoolsets. Figure 1, Figure 2 and Figure 3 provide the list of toolsets used by this group.
Figure 1 Utilities used by APT10
Tool Namecertutil

cmd
Net

Ping
PsExecDescription
Certutil is a Windows command line utility that can dump and display certification
authority (CA) configuration information and configure certificate services. APT10
has used this tool to decode binaries hidden inside certificate files as Base64
information. It also has been used to download files from a given URL.
Cmd is a Windows command line utility that is used to locate, execute, copy anddelete files into local or remotely connected victim.
The Net command is a command line utility that can be used to manage network
settings including network shares, network services, network users, and network
connections.
Ping is the network software utility that has been used to discover remote systems
within a network.
PsExec is a light-weight Microsoft tool that executes processes on other systems,
complete with full interactivity for console applications, without having to manually
install client software.

© Cysiv LLC, 2019. All rights reserved.
5

Figure 2 Malware families used by APT10
Tool Name
ChChes(Scorpion,
Haymaker)Type
TrojanEvilGrab

TrojanPlugX(Sogu)

RAT

PoisonIvy

RAT

RedLeaves(Bugjuice)

RAT

Snugride

Back
door

Uppercut

Back
door

Scanbox

Reconnaissance
Frame
work

Description
This is a Trojan that has been used exclusively by APT10 and acts as asystem fingerprinting utility. It uses HTTP to communicate to its C&C
server. Even though it can execute just a few functions by itself, its
functionality can be extended by receiving modules from C&C servers andloading them into memory.
EvilGrab is a Trojan that has the capability to capture the audio, video andscreen of the victims and send them to C&C servers. It has common
reconnaissance capabilities such stealing credentials, instant messaging
chat logs, keystrokes and also has the capability to access to the victims’
machines remotely.
Plugx is a modular RAT that can execute a wide variety of commands,
including uploading and downloading files, and spawning a reverse shell.
The malware can be configured to use multiple network protocols to avoid
network-based detection. DLL side loading is often used to maintainpersistence on the compromised system.
PoisionIvy is a RAT that opens a backdoor on the compromised computerand has keylogging capabilities. The RAT is controlled through a familiar
Windows interface and offers several features: key logging, screen
capturing, video capturing, file transfers, password theft, systemadministration, traffic relaying, and more.
The RedLeaves implant is a remote administration trojan (RAT) that is built
in Visual C++ and contains a number of functions typical of RATs, including
system enumeration, command execution, command window generationand network traffic compression and encryption. The backdoor
communicates over TCP using a custom binary protocol to communicate
with its C&C. It also can use HTTP and HTTPs if directed by the C&C.
This backdoor is usually used as the first stage backdoor by APT10 andhas several capabilities such as taking a system survey, access to thefilesystem, executing commands and a reverse shell. Its C&C
communication is over HTTP and encrypted using AES with static key.
This is another backdoor used by APT10 that is also known as ANEL. It
has ability to collect information on the victim’s machine and send theinfected environment’s information to the C&C server. When sending theinformation, Uppercut encrypts the data using blowfish, XOR, and Base64based encryption methods. The format this backdoor uses to send data issimilar to ChChes, but its encryption method is easier to use.
Scanbox is a reconnaissance framework used by several Chinese APTgroups, including APT10, that enables attackers to track visitors tocompromised websites, performs keylogging, and harvest data that could
be used to enable follow-on compromises. It has the capability to deliver
secondary malware on targeted hosts.

© Cysiv LLC, 2019. All rights reserved.
6

Figure 3 Open Source tools used by APT10
Tool Name
Mimikatz
Power
SploitType
InfoStealer
Offensive
security
framework

PwdumpCredential
DumperImpacket

Networking
tool

QuasarRat

Description
Mimikatz is an open-source application that is designed to steal
credentials.
PowerSploit is an open source penetration testing frameworkcomprises of a collection of Microsoft PowerShell modules that canperform code execution, persistence, bypassing anti-virus, recon, andexfiltration.
This utility dumps the password database of an NT machine that isheld in the NT registry (under
HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users)
into a valid smbpasswd format file.
Impacket is a collection of Python classes for working with network
protocols. It has several capabilities such as remote service
execution, Kerberos manipulation, Windows credential dumping,
packet sniffing, and relay attacks.
Quasar is an open source RAT that has a built-in keylogger to monitor
mouse and keyboard events. It also has the capability to steal
credentials from browsers and FTP clients and launch a remote shell
to execute commands on the victim’s machine.

© Cysiv LLC, 2019. All rights reserved.
7

4 MITRE ATT&CK MATRIX
Here is the list of the most common TTPs used by APT 10, based on the MITRE ATT&CK matrix.
Figure 4 Most common TTPs used by APT10
InitialAccessExecution

Persistence

Privilege
Escalation

DefenseEvasionCredential
AccessDiscovery

LateralMovement

Collection

C&C

Exfiltration

Spearphishing
Attachment
TrustedRelationshipWindows
Management
Instrumentati
onPowerShell

DLL Search
Order
Hijacking

DLL Search
Order
Hijacking

CredentialDumping

System Network
Connections
Discovery

RemoteDesktopProtocolData from Local
SystemConnec
tion
Proxy

Data
Compressed

Valid
Accounts

Scheduled
Task

Deobfuscate/DecodeFiles orInformation
DLL Search
Order
Hijacking

Input
CaptureSystem Network
Configuration
Discovery

RemoteFile Copy

Data from
Network Shared
Drive

Standard
CryptoProtocols

Data
Encrypted

Remote System
Discovery
Network Service
Scanning
Account Discovery

RemoteServices

Data Staged

Scheduled
Task
Scripting

Process
Injection

User
Execution
CommandLine Interface
Execution
Through API

DLL SideLoding
File Deletion
Masquerading
ObfuscatedFiles orInformation
Process
Hollowing
Scripting
Valid
Accounts© Cysiv LLC, 2019. All rights reserved.

Input Capture
Clipboard Data

Impact5 CAMPAIGNSIn the past few years, APT10 has conducted several campaigns around the globe thathas stolen sensitive data from millions of people. The following sections analyze
campaigns that have been operated by APT10.

5.1 Menu Pass
The “Menu Pass” attack has been active from 2009 to 2013, with a spike in 2012. It
targeted the defense industry and international government agencies, and attempted tosteal military intelligence. In this campaign, spear phishing emails used attachments,
which were meant to look like a purchase order or price quote that would be fairly
specific to the victim, were infected with PoisonIvy.

5.2 Cloud Hopper
One of the most interesting APT10 campaigns that happened between late November
2016 and early 2017 was called “ClouldHopper”. In this campaign, the actor targeted
several Managed Service Providers (MSPs) and was able to get access to theintellectual property and sensitive data of those MSPs and their clients globally. At thetime, they also targeted several Japanese organizations.
In this campaign, APT10 switched its attack vector to target MSPs because this allowed
them to move laterally over the MSP network to the MSP’s client’s network. In this way,by infecting an MSP they could access a large number of MSP customers. Moreover,
the actor exfiltrated the MSP’s client’s data stealthy by misusing the trust
communication between MSP’s network and MSP’s client’s network.
PlugX, RedLeaves, Quasar Rat, Mimikatz, nbtscan and Pwddump have been used toperform APT10 operations. In this campaign, Redleave was used as a first stage lightweight backdoor that was delivered via a spear phishing attack. After gathering initial
information about the targets, which was collected by Redleave, the actor used PlugX
and Quasar, which have a comprehensive feature set that is required to collect requiredinfo.

5.3 Chess Master
ChessMaster is another campaign operated by APT10 in July 2017 targeting Japanese
academic, technology, media and MSP companies, and government agencies. It© Cysiv LLC, 2019. All rights reserved.

9

employed spear-phishing emails containing decoy document to infect victims. In thiscampaign APT10 used a variety of tools and techniques such as:
•
•
•

•

•

•

•

TinyX: A variant of PlugX backdoor with a modular structure that allowed it toadopt new capabilities. It was bundled separately in spear-phishing emails.
ChChes: ChChes backdoor was used as a second-stage payload that useddifferent encryption methods and C&C communications.
RedLeaves: RedLeaves is another second stage backdoor used in thiscampaign that operates like the open-source and fileless remote access trojan(RAT) Trochilus, which is known for enabling lateral movement in the infected
systems.
Runtime packers: The second stage backdoor, ChChes, employed threepackers to obfuscate itself and avoid detection:o Packer without encryptiono Packer that employed anti-emulation XOR encryption techniqueo The packer employed an AES algorithm on top of XOR encryption
Malicious shortcut (LNK) files and PowerShell: LNK files have been used as
an attachment of spear phishing emails. Upon opening the LNK file, it executed a
Command Prompt that downloads a PowerShell script, which would either
directly drop or reflectively load ChChes into the machine to make ChChes afileless malware.
Self-extracting archive (SFX): APT10 in the campaign used SFX archine five toemploy its DLL hijacking method. SFX archive dropped an executable (EXE), a
dynamic-link library (DLL), and a binary file (.BIN). Upon their extraction,
malicious code was injected into the process of a legitimate file/application (DLL
hijacking).
Hacking Tools: Email and browser password recovery and dumping tools havebeen used in this campaign. These tools had the capability to restore forgotten
passwords and use for lateral movement.

5.4 White Fly
In July 2018, SigHealth, the largest healthcare organization in Singapore, was targetedby APT10. Symantec reported this attack and called it WhiteFly. APT10 remained
within the targeted organization for a long period of time and were able to steal 1.5
million patient records. Several variants of PlugX backdoor, Mimikataz, and a new RAT
called Vcrodat were used by the actor in this campaign.

© Cysiv LLC, 2019. All rights reserved.

10

The attack started by sending phishing emails that pretended to offer information on job
openings or appear to be documents sent from another organization operating in thesame industry, to the victim. The document or image contained a malicious executable
dropper that dropped the Vcrodat backdoor using the DLL search order hijacking
technique. This is the same technique usually used by this APT to lunch PoisonIvy
backdoor.
Once executed, Vcrodat loaded an encrypted payload on to the victim’s computer.
This backdoor collected the system information about the infected computer and sent
them to the C&C server. It also had the capability to download additional tools. After
collecting the information, APT10 used a second piece of custom malware that
Symantec labeled “Trojan.Nibatad”, a variant of PlugX, to exfiltrate the stolen data.

5.5 Hogfish Redleaves (New Battle)
On May 2018 researchers reported a new APT10 operation called “HogFish
RedLeaves”, which attacked several Japanese organizations. In this campaign, APT10
used its favorite method to infect victims: sending phishing emails which dropped the
RedLeave backdoor. The variant of Redleave used in this attack had the following
capabilities:••••

Take screenshots
Gather browser usernames and passwords
Gather extended system information
Send, receive, and execute commands from the C&C server (RedLeaves willattempt to communicate over HTTP, using POST requests with a hardcoded
User-Agent)

5.6 Trade Secret
In Feb 2017, security researchers observed a strategic web compromise on a prominent
U.S. lobbying group that served up malware to target key private-sector players
involved in lobbying efforts around United States foreign trade policy. At the same time,
the attacker launched a similar attack against Japan’s government officials.
In this operation, named Trade Secret, visitors to compromised websites, which areused to register for specific meetings at the National Foreign Trade Council, were
infected by Scanbox malware framework.

© Cysiv LLC, 2019. All rights reserved.

11

Scanbox is a framework written in JavaScript and PHP that allows an attacker toperform reconnaissance and key logging of visitors to a compromised website without
requiring any malware to be downloaded or installed. Here is list of scanbox plugins:
•
•
•
•
•
•
•
•

Applications enumeration
Browser info reconnaissance
Adobe Flash reconnaissanceSharePoint reconnaissanceJava versions enumeration
JavaScript keylogger
Microsoft Office reconnaissance
Network reconnaissance

5.7 Soft Cell
In 2018, a group of researchers identified an advance persistent campaign that targeted
several global telecommunications providers. Evidence suggests that this campaign has
been active since 2012. The campaign goal was to obtain CDR records of a large
telecommunications provider.
Based on techniques, tactics and procedures used in this campaign, the researchers
associated this campaign to APT10. This attribution is relative, and it could be the workof other similar Chinese APTs such as Deep Panda. The campaign continued forseveral months and had four stages. In the first stage of attack, APT compromised apublic vulnerable web server with a web shell from which the attackers gathered
information about the network and propagated across the network. The threat actor wasable to leverage the web shell to run reconnaissance commands, steal credentials, anddeploy other tools. Upon detection by security teams, the attackers stopped its
operations for a few months.
The second stage of attack happened four months later in which the attacker usedsimilar set of tools and techniques as those used in stage one. Again, as malicious
activity was detected and remediated against, the threat actor stopped the attack. The
process of resuming, and stopping upon detecting, happened two more times.
During this operation, the attacker used several toolsets and techniques:•

Several custom web shells were used to run reconnaissance commands, steal
credentials, and deploy other tools.

© Cysiv LLC, 2019. All rights reserved.

12

•

•
•

•
•
•

•

5.7.1

Several enumeration commands were used to obtain and enumerate information
about the compromised machines, network architecture, users, and active
directory enumeration.
A modified version of nbtscan was used to identify available NetBIOS nameservers locally or over the network.
A modified version of Mimikatz was used to dump credentials stored on thecompromised machines. This version of mimikatz did not require any commandline arguments, most likely in an attempt to avoid detection based on commandline auditing.
The actor also used another technique that dumped specific hives fromthe Windows Registry, such as the SAM hive, which contains password hashes.
It used WMI and PsExec to move laterally over the network.
In order to maintain a long-term foothold and stealing information, the APT groupabused the stolen credentials to create rogue, high-privileged domain user
accounts, which they then used to take malicious action.
The actor used a variant of PoisonIvy to maintain access across thecompromised assets and steal information on the infected hosts. PoisonIvy is a
powerful, multi-featured RAT that lets a threat actor take total control over amachine and has the following features:o Registry Editoro 1Screenshot Grabbero Credential Stealero Interactive Shello File Manager with Upload and Download Support
o Process Monitor
o Keylogging and Various other Surveillance Features

OVERVIEW OF POISIONIVY

The variant of poisonIvy used in this attack is a Nullsoft Scriptable Install System (NSIS)
that employed a DLL side-loading technique to stealthily load itself into memory. To dothis, it exploited a legitimate signed application, in this case Runhelper.exe, which is alegitimate signed Samsung tool, to load the PoisonIvy payload into memory. NSIS
installer is an archive file includes Runhelper.exe and a fake DLL with the same nameas a legitimate DLL (ssMUIDLL.dll), which is required by the application. After the fake
DLL was loaded by the Runhelper.exe, it decrypted a payload in the same folder, which© Cysiv LLC, 2019. All rights reserved.

13

contains the actual PIVY payload. Then it made itself persistent by creating a scheduled
task. The behavioral process graph of this backdoor is shown in Figure 5.
Figure 5 Process view

© Cysiv LLC, 2019. All rights reserved.

14

5.8 Others
Besides the major operations that APT10 conducted, they also attacked several
individuals, universities and other organizations:
•

•
•
•

•

According to several reports, the Marriot International breach on November 2019that resulted in the theft of data from 500 Million guest, was the operation of APT10.
The attackers targeted the Starwood guest reservation database, which contained
details of reservations that were made on or before 10 September 2018. The mostdiscerning revelation of the Marriott investigation is that the hackers gained accessto the Starwood network, back in 2014 without being detected. Still, there’s no
information about the malware family that was used by APT10 in this campaign.
APT10 also targeted the Japanese media sector in July 2018. In this attack, theactor used spear phishing as its initial infection vector to install Uppercut backdoor.
In October 2016, APT10 attacked several Japanese organizations using ChChes
backdoor.
Between November 2017 and September 2018, APT10 targeted at least threecompanies in the United States and Europe, including:o Visma: A Norwegian IT and business cloud services MSP that has at least
850k customers globallyo An international apparel companyo A U.S law firm
Interestingly, in this campaign, attackers gained access to victim networks via
deployments of Citrix and LogMein remote-access, using stolen valid user
credentials, and then they conducted enumeration and privilege escalation on thetargeted networks. To deploy the malware on the victims, they used the DLL side
loading technique. RedLeaves and Uppercut have been used by APT10 in thiscampaign. The stolen data was compressed using WinRAR and then exfiltrated to a
Dropbox account using cURL.
One of the most recent APT10 campaigns was uncovered by Ensilo researchers on
May 24, 2019. In this attack, the actor targeted organizations in South East Asia.
Similar to its previous campaigns, it employed some specific variants of PlugX andQuasar rat that were loaded into memory using DLL side loading technique.

© Cysiv LLC, 2019. All rights reserved.

15

6 APT10’S NETWORK BEHAVIOR
APT10 malware toolset is known to use different protocols for their C&C
communications. They usually are capable of performing communication over TCP
using DNS, HTTP and HTTPS. The server is able to change type of C&C
communications on the infected host.
The C&C infrastructures used by APT10 in its campaigns are based on dynamic
domains. They employed lots of highly interconnected domains through shared IP
address hostings that sometimes linked back historically to the actor’s previous
operations.
For example, in operation Cloud Hopper they employed thousands of dynamic domains
in their infrastructure. To give you an idea of its size, Figure 6 shows the high-level viewof this infrastructure in the Cloud Hopper operation of 2016 provided, by PWC. As thecampaign progressed into 2017, the number of dynamic domains increased
significantly.
Figure 6 High-level view of infrastructure used in operation Cloud Hopper in 2016

© Cysiv LLC, 2019. All rights reserved.

16

7 IOCS
The list of IOCs’ is available in a separate CSV file.

© Cysiv LLC, 2019. All rights reserved.

17