Threat Actor: APT10 (Stone Panda)
APT10 (Stone Panda) is classified as an advanced Nation-State APT originating primarily from China (Ministry of State Security, Tianjin Bureau). Driven by operational objectives spanning large-scale intellectual property theft & managed service provider (msp) island hopping, this threat entity has maintained an active footprint from 2009 - Present. In enterprise telemetry and malware repository classification, APT10 (Stone Panda) has been corroborated across 3 distinct malware families with over 648 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | MenuPass, Stone Panda, Red Apollo, CVNX, Potassium |
|---|---|
| Targeted Sectors | Global IT Managed Service Providers, Aerospace, Heavy Engineering, Commercial Manufacturing |
| Primary Motivations | Large-Scale Intellectual Property Theft & Managed Service Provider (MSP) Island Hopping |
| Dominant Payload Categories | Rat |
| MITRE ATT&CK Reference | https://attack.mitre.org/groups/G0045/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by APT10 (Stone Panda):
T1056.001— weaponized across 3 catalog payload(s)T1059.003— weaponized across 2 catalog payload(s)T1055— weaponized across 2 catalog payload(s)T1113— weaponized across 2 catalog payload(s)T1071.001— weaponized across 2 catalog payload(s)T1547.001— weaponized across 2 catalog payload(s)T1571— weaponized across 1 catalog payload(s)T1125— weaponized across 1 catalog payload(s)T1574.002— weaponized across 1 catalog payload(s)T1091— weaponized across 1 catalog payload(s)T1543.003— weaponized across 1 catalog payload(s)T1573.002— weaponized across 1 catalog payload(s)T1021.001— weaponized across 1 catalog payload(s)T1082— weaponized across 1 catalog payload(s)T1041— weaponized across 1 catalog payload(s)
Exploited Vulnerabilities (CVEs)
Telemetry confirms APT10 (Stone Panda) has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2012-0158 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2014-1761 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-0199 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2017-11882 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2020-0688 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (3 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to APT10 (Stone Panda):
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| farfli | Rat | 360 | Trojan:Win32/Farfli is a sophisticated Remote Access Trojan (RAT) derived from the leaked Gh0st RAT codebase, customized extensively by Chinese state-sponsored ... |
| quasarrat | Rat | 280 | QuasarRAT (frequently tracked as Quasar, Quasar Remote Administration Tool, and Backdoor:MSIL/Quasar) is a powerful open-source remote access trojan coded in C#... |
| plugx | Rat | 8 | PlugX (also known across threat intelligence teams as Korplug or Sogu) is an exceptionally sophisticated, highly modular Remote Access Trojan first observed in ... |
Official US Federal & CISA Advisories
Official intelligence alerts and joint cybersecurity advisories published regarding APT10 (Stone Panda) operations:
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by APT10 (Stone Panda) requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).