APT10 showed that the cheapest way into hundreds of organisations is through the one supplier that already holds administrator access to all of them. The group, which MITRE ATT&CK tracks as menuPass, compromised managed service providers (MSPs) from about 2014 and used their legitimate credentials and network links to reach client networks in at least twelve countries. In December 2018 the United States charged two members and the United Kingdom attributed the campaign, known as Cloud Hopper, to China's Ministry of State Security (MSS). The campaign is historic, but the trust model it abused is still how most MSPs operate. This profile is for third-party risk owners, identity and PAM teams, and MSP security leads. It covers names and attribution as stated by governments, targeting, ATT&CK techniques, the MSP credential abuse pattern, notable incidents and defences. For the response steps when a provider is breached, use the Compromised MSP Playbook.
Key takeaways
- The MSP is the initial access vector. ATT&CK records that menuPass used legitimate access granted to MSPs to reach victims of interest (T1199 Trusted Relationship) and valid accounts shared between MSPs and clients (T1078).
- Stolen administrator credentials did the lateral movement. The US Department of Justice describes the group installing credential-stealing malware at MSPs, then using stolen administrative credentials to move into MSP systems and client networks.
- Data left through the provider. ATT&CK records data staged on remote MSP systems before exfiltration (T1074.002), so the client's own egress monitoring saw nothing unusual.
- Attribution is governmental, not only vendor. The UK NCSC assessed "with the highest level of probability" that APT10 was responsible for Cloud Hopper and judged it highly likely the group has an enduring relationship with the MSS.
- The defence is identity design. Separate, named, MFA-protected, least-privilege accounts per provider engineer, time-bound access, and logging the client owns break the pattern this group relied on.
Who they are (names and aliases)
ATT&CK tracks the group as menuPass (G0045), active since at least 2006, and states that individual members acted in association with the MSS Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. The December 2018 DOJ release names two Chinese nationals, Zhu Hua and Zhang Shilong, as members of the APT10 Group who worked at Huaying Haitai in Tianjin and acted in association with the Tianjin State Security Bureau; the charges are allegations. On the same day the UK government stated that the NCSC judged it highly likely that APT10 has an enduring relationship with the MSS and operates to meet Chinese state requirements, and that the UK therefore judged the MSS responsible.
| Name | Source | Notes |
|---|---|---|
| APT10 | Mandiant, US DOJ, UK NCSC | Most common public name |
| menuPass | MITRE ATT&CK (G0045), Palo Alto Networks | ATT&CK primary name |
| Stone Panda, Red Apollo, CVNX, POTASSIUM | Listed as aliases in the DOJ release | CVNX is also given as an alias of defendant Zhu Hua |
| Cicada, HOGFISH, BRONZE RIVERSIDE | Associated names in ATT&CK | Symantec, Accenture and Secureworks reporting |
Cloud Hopper is the name of the campaign (from PwC UK and BAE Systems reporting in 2017), not of the group.
Targeting and motivation
- MSP campaign (from about 2014): the DOJ lists victims in at least twelve countries, including the United States, United Kingdom, Japan, Germany, France, Canada, India, Brazil, Sweden, Switzerland, Finland and the United Arab Emirates, across banking and finance, telecommunications, consumer electronics, medical equipment, manufacturing, consulting, healthcare, biotechnology, automotive, oil and gas, and mining.
- Technology theft campaign (from about 2006): the DOJ alleges more than 45 technology companies and US government agencies were compromised, and that data on more than 100,000 US Navy personnel was stolen.
- Emphasis on Japan: ATT&CK notes a long-standing emphasis on Japanese organisations, with later reporting (Kaspersky, 2021) describing Japanese-linked targeting and abuse of Pulse Secure VPN vulnerabilities to hijack sessions.
- Motivation: the UK government describes the Cloud Hopper aim as stealing intellectual property and commercially sensitive data, likely for commercial espionage.
- Why MSPs: one provider compromise yields administrator access, network routes and trusted remote tooling into many clients at once, and the traffic looks like normal support work.
Tactics and techniques (MITRE ATT&CK)
All techniques below are mapped to G0045 in ATT&CK v20.
| Tactic | Technique | How it shows up |
|---|---|---|
| Initial access | T1199 Trusted Relationship; T1078 Valid Accounts | Legitimate MSP access and accounts shared between MSPs and clients |
| Initial access | T1566.001 Spearphishing Attachment; T1190 Exploit Public-Facing Application | Office documents and disguised executables; Pulse Secure VPN vulnerabilities in later activity |
| Execution | T1047 Windows Management Instrumentation; T1053.005 Scheduled Task | Modified wmiexec.vbs and atexec.py from Impacket |
| Credential access | T1003.002 Security Account Manager; T1003.004 LSA Secrets; T1003.003 NTDS | secretsdump.py, Mimikatz, pwdump, Ntdsutil |
| Credential access | T1056.001 Keylogging | Keyloggers to capture usernames and passwords |
| Discovery | T1087.002 Domain Account | csvde.exe export of Active Directory data |
| Lateral movement | T1021.001 Remote Desktop Protocol; T1210 Exploitation of Remote Services | RDP across networks; ZeroLogon (CVE-2020-1472) in reporting from 2020 |
| Stealth | T1574.001 DLL; T1070.003 Clear Command History | DLL side-loading of Mimikatz and implants; wevtutil to remove PowerShell logs |
| Collection | T1039 Data from Network Shared Drive; T1560.001 Archive via Utility | net use and Robocopy; multi-part RAR and TAR archives |
| Collection, exfiltration | T1074.002 Remote Data Staging; T1090.002 External Proxy | Data staged on MSP systems; a global service provider's IP used as C2 proxy |
Malware families linked to the group in ATT&CK include PlugX, RedLeaves, ChChes, QuasarRAT, UPPERCUT, PoisonIvy, SodaMaster and P8RAT. Malware changes; the trust abuse pattern does not, so build detections on behaviour.
How they abuse identities and credentials
Cloud Hopper is a case study in what happens when a supplier's identities are effectively the client's administrators.
| Step | What the actor did | Identity control that breaks it |
|---|---|---|
| 1. Enter the MSP | Phishing and malware inside the provider, disguised as operating system files (DOJ) | Client contracts require MFA, EDR and logging at the provider; ask for evidence |
| 2. Steal admin credentials | Credential dumping and keylogging on MSP systems | Provider engineers use privileged access workstations and a PAM tool; no reusable domain admin passwords stored on jump hosts |
| 3. Cross into clients | Valid accounts and network links shared between MSP and clients (T1199, T1078) | One named account per engineer per client, never shared; MFA enforced by the client's own identity provider; no standing network trust |
| 4. Escalate inside the client | SAM, LSA secrets and NTDS dumping; ZeroLogon in later activity | Provider accounts are not domain admins by default; just-in-time elevation; patch domain controllers first |
| 5. Stage and exfiltrate | Archives moved to MSP systems, then out (T1074.002) | Restrict and monitor large transfers to provider networks; client-owned logs of provider sessions |
- Shared accounts were the multiplier: ATT&CK explicitly records accounts shared between MSPs and clients. A shared account cannot be attributed, rotated safely or tied to MFA. See the Vendor Privileged Access Management (VPAM) Guide.
- Delegated cloud admin is the modern equivalent: partner relationships in Microsoft 365 and other clouds give providers tenant-wide rights. Move to granular, time-bound roles. See the GDAP and MSP Delegated Admin Access Guide.
- Remote tooling is a non-human identity: RMM agents, backup agents and automation service accounts run with high rights on every client endpoint. Inventory them and their credentials. See the Unauthorised Remote Monitoring and Management Tool Playbook.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| About 2006 onwards | Technology theft campaign against more than 45 technology companies and US government agencies, including NASA Goddard Space Flight Center and the Jet Propulsion Laboratory; data on more than 100,000 US Navy personnel | US DOJ, December 2018 |
| About 2014 onwards | MSP campaign reaching clients in at least twelve countries through provider credentials | US DOJ, December 2018 |
| April 2017 | Public reporting of Operation Cloud Hopper by PwC UK and BAE Systems | Cited in ATT&CK G0045 |
| 20 December 2018 | US indictment of Zhu Hua and Zhang Shilong; UK attribution of Cloud Hopper to the MSS | US DOJ; UK government |
| 2020 to 2021 | Reporting on Japanese-linked targeting, ZeroLogon exploitation and Pulse Secure VPN session hijacking | Symantec (November 2020) and Kaspersky (March 2021), cited in ATT&CK |
Detection and defence
Detection signals
| Signal | Where | Notes |
|---|---|---|
| Provider accounts signing in outside agreed hours, from new source networks, or to systems outside the contract scope | Identity provider and Windows logon events (4624 with logon type 10 for RDP) | Baseline each provider account; scope is the strongest signal |
| Provider account added to privileged groups | Domain controller Event IDs 4728, 4732 and 4756 | Should only happen through a change ticket |
| Ntdsutil, csvde or secretsdump-style remote registry access | EDR, process creation logs | Directory export and credential dumping |
| Large archive creation (RAR, TAR) followed by transfer to provider subnets | EDR, NetFlow, file server audit | Remote staging pattern |
| Security or PowerShell log clearing (Event ID 1102, wevtutil cl) | Windows event forwarding | Forward logs off-host so clearing is visible |
| Signed binaries loading DLLs from unusual paths | EDR image load telemetry | DLL side-loading of implants |
Hardening plan for MSP customers
- Inventory: list every provider, every account and agent it uses in your estate, the rights each holds and the network paths it relies on. Remove anything nobody can explain.
- Replace shared accounts: issue named accounts per engineer, federated or created in your identity provider, with MFA enforced on your side. Pilot with one provider, confirm support workflows still work, then roll out.
- Cut standing privilege: no provider account in Domain Admins or Global Administrator by default; use just-in-time elevation through a PAM tool with session recording.
- Restrict network trust: replace site-to-site tunnels with brokered, per-session access; block provider subnets from reaching file servers except through approved paths.
- Own the logs: keep provider session and sign-in logs in your SIEM, not only in the provider's tooling.
- Contract and test: write MFA, logging, incident notification and right-to-audit requirements into the contract, and run a tabletop of a provider compromise every year.
Rollback: if named accounts break an urgent support process, issue a time-limited break-glass account with MFA and alerting rather than reinstating a shared account.
Metrics
- Shared provider accounts: target zero.
- Provider accounts with standing privileged group membership: target zero.
- Provider sessions with recording and client-side logging: target 100 per cent.
- Time to disable all access for one provider: tested, target under one hour.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | SA-9 External System Services, SR-6 Supplier Assessments and Reviews | Provider security requirements and review |
| NIST SP 800-53 Rev. 5 | AC-2 Account Management, IA-2 Identification and Authentication, AC-17 Remote Access, AU-6 Audit Record Review | Named, MFA-protected, logged provider access |
| NIST CSF 2.0 | GV.SC-05, GV.SC-07, PR.AA-05, DE.CM-06 | Supplier contracts, supplier risk monitoring, least privilege, monitoring of external providers |
Practitioner checklist
- Produce a register of every MSP account, agent and network path in your environment, with an owner.
- Eliminate shared accounts between your organisation and any provider.
- Enforce MFA for provider accounts in your own identity provider, not only at the provider.
- Remove standing domain and tenant administrator rights from provider accounts.
- Patch domain controllers for CVE-2020-1472 and confirm enforcement mode.
- Forward provider sign-in, session and privileged group change events to your SIEM.
- Add MFA, logging, notification and audit clauses to provider contracts. See the Third-Party Security Contract Clauses Template.
- Rehearse cutting off a provider in under an hour.
Standards and references
- US Department of Justice: Two Chinese hackers associated with the Ministry of State Security charged with global computer intrusion campaigns
- UK Government: UK and allies reveal global scale of Chinese cyber campaign
- MITRE ATT&CK: menuPass (G0045)
- MITRE ATT&CK: Trusted Relationship
- MITRE ATT&CK: Data Staged: Remote Data Staging
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
Related NHI Mgmt Group resources: Compromised MSP Playbook · Cybersecurity for MSPs and MSSPs Guide · Third-Party Access Guide · China State Cyber Operations Guide · Threat Actor Groups Guide