APT10
Attribution profile
- Type
- Nation State
- Location
- China
- Known incidents
- 23 incidents
- Sources
- 9 sources
- First seen
- 2006-01-01
- Last seen
- 2024-01-01
- Updated
- 2026-10-14 05:14
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Stone Panda, also known as APT10, POTASSIUM, and Red Apollo, is a China‑based threat actor linked to the Ministry of State Security. The group has targeted vaccine manufacturers in India, government and human rights organizations in Hong Kong, technology service providers and managed service providers globally, and entities involved in THAAD deployment in South Korea, seeking to exfiltrate intellectual property and gain competitive or strategic advantage for China. Its observed tactics include spear‑phishing with malicious attachments, exploitation of weak web servers, applications and content‑management systems, use of stolen credentials to access managed service provider networks, deployment of the ScanBox reconnaissance framework for keylogging and system profiling, and password‑stealing tools; stolen data are often compressed and renamed to evade detection. Notable publicly reported operations include the 2021 espionage campaign against the Serum Institute of India and Bharat Biotech, the 2019 compromise of a Pakistani passport‑tracking site delivering ScanBox, the 2019 intrusion into Norwegian software firm Visma as part of the Cloudhopper campaign, and the 2017‑2018 Cloudhopper intrusions of multiple technology service providers such as IBM and Hewlett Packard Enterprise to reach client networks for economic espionage.
Incidents
Attributed incidents are available to members.
23 incidentsSources
Sources available to members: 9 sources.