Actors/Nation-state / APT/Asia

APT10

G0045APTCN · China

AKA Red Apollo · menuPass · Granite Typhoon · HOGFISH · Cloud Hopper · CVNX · ATK41 · ITG01

Microsoft: POTASSIUMCrowdStrike: STONE PANDAMITRE: G0045Proofpoint: TA429Secureworks: BRONZE RIVERSIDE

Targets19

Sectors14

Threat types1

GIRs covered0/480

Active since2009

Also tracked as

6 vendor names · 8 other aliases

Open Rosetta Stone

CrowdStrike

STONE PANDA

Mandiant

APT10

Microsoft

POTASSIUM

MITRE

G0045

Proofpoint

TA429

Secureworks

BRONZE RIVERSIDE

UNATTRIBUTED ALIASESRed ApollomenuPassGranite TyphoonHOGFISHCloud HopperCVNXATK41ITG01

Victimology

Geographic footprint · 19 countries

origin · Chinatargeted countries · 19

ASIA · 4

United Arab Emirates · India · Japan · Malaysia

OCEANIA · 1

Australia

AMERICAS · 3

Brazil · Canada · United States

EUROPE · 9

Switzerland · Germany · Denmark · Finland · France · United Kingdom · Italy · Netherlands · Sweden

AFRICA · 2

Gabon · South Africa

Sectors targeted

14 of 40

Government100 actors Aerospace59 actors Financial Services74 actors Healthcare47 actors Pharmaceutical27 actors Technology60 actors Telecom72 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Manufacturing (man)50 actors Consulting / Professional Services35 actors Private Sector (generic)29 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 41 techniques

Resource Development · 1

T1583.004Server

Initial Access · 3

T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment

Execution · 5

T1047Windows Management Instrumentation

Credential Access · 4

T1003.001LSASS Memory

Discovery · 6

T1016System Network Configuration Discovery

Lateral Movement · 5

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 5

T1005Data from Local System T1039Data from Network Shared Drive T1119Automated Collection

Exfiltration · 1

T1041Exfiltration Over C2 Channel

Command And Control · 1

T1105Ingress Tool Transfer

Stealth · 10

T1027Obfuscated Files or Information

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer41 techniques · layer format 4.5

Related actors

By origin and actor type

T1053.005

Scheduled Task

T1059.001PowerShell

T1059.003Windows Command Shell

T1106Native API

T1003.002

Security Account Manager

T1003.003NTDS

T1003.004LSA Secrets

T1018

Remote System Discovery

T1033System Owner/User Discovery

T1046Network Service Discovery

T1049System Network Connections Discovery

T1083File and Directory Discovery

T1210

Exploitation of Remote Services

T1550.002Pass the Hash

T1570Lateral Tool Transfer

T1560

Archive Collected Data

T1560.001Archive via Utility

T1027.002

Software Packing

T1036Masquerading

T1036.003Rename Legitimate Utilities

T1036.005Match Legitimate Resource Name or Location

T1055.012Process Hollowing

T1070.004File Deletion

T1078Valid Accounts

T1140Deobfuscate/Decode Files or Information

T1218.004InstallUtil