APT10 and Cloud Hopper
There’s a new report of a nation-state attack, presumed to be from China, on a series of managed ISPs. From the executive summary:
Since late 2016, PwC UK and BAE Systems have been assisting victims of a new cyber espionage campaign conducted by a China-based threat actor. We assess this threat actor to almost certainly be the same as the threat actor widely known within the security community as ‘APT10’. The campaign, which we refer to as Operation Cloud Hopper, has targeted managed IT service providers (MSPs), allowing APT10 unprecedented potential access to the intellectual property and sensitive data of those MSPs and their clients globally. A number of Japanese organisations have also been directly targeted in a separate, simultaneous campaign by the same actor.
We have identified a number of key findings that are detailed below.
APT10 has recently unleashed a sustained campaign against MSPs. The compromise of MSP networks has provided broad and unprecedented access to MSP customer networks.
- Multiple MSPs were almost certainly being targeted from 2016 onwards, and it is likely that APT10 had already begun to do so from as early as 2014.
- MSP infrastructure has been used as part of a complex web of exfiltration routes spanning multiple victim networks.
[…]
APT10 focuses on espionage activity, targeting intellectual property and other sensitive data.
- APT10 is known to have exfiltrated a high volume of data from multiple victims, exploiting compromised MSP networks, and those of their customers, to stealthily move this data around the world.
- The targeted nature of the exfiltration we have observed, along with the volume of the data, is reminiscent of the previous era of APT campaigns pre-2013.
PwC UK and BAE Systems assess APT10 as highly likely to be a China-based threat actor.
- It is a widely held view within the cyber security community that APT10 is a China-based threat actor.
- Our analysis of the compile times of malware binaries, the registration times of domains attributed to APT10, and the majority of its intrusion activity indicates a pattern of work in line with China Standard Time (UTC+8).
- The threat actor’s targeting of diplomatic and political organisations in response to geopolitical tensions, as well as the targeting of specific commercial enterprises, is closely aligned with strategic Chinese interests.
I know nothing more than what’s in this report, but it looks like a big one.
Press release.
Subscribe to comments on this entry
Carl Byoir • April 5, 2017 11:23 AM
The press release claims that this op is “thought to be one of the largest ever sustained global cyber espionage campaigns in an operation.”
The breathless quality is hardly surprising.
But what should raise questions is why Mr. Schneier is so quick to amplify this message by repeating it on his own site with very little skepticism outside of a perfunctory qualification: “I know nothing more than what’s in this report”
But, hey, it’s could public relations for a security company to get their name spread around. Who cares if it’s true or not?