Ajay Kumar: Created a new article

2023-09-25T18:45:26Z

Created a new article

New page

{{short description|Chinese cyberespionage group}}
{{about|the threat actor|the butterfly|Parnassius epaphus|the element|Potassium}}
{{Infobox organization
| name = Red Apollo
| named_after =
| image =
| alt =
| formation = {{circa}} 2003–2005{{ref|a}}
| type = [[Advanced persistent threat]]
| purpose = [[Cyberespionage]], [[cyberwarfare]]
| motto =
| headquarters =
| region = [[China]]
| methods = [[Zero-day (computing)|Zero-day]]s, [[spearphishing|Phishing]], [[backdoor (computing)]], [[Remote Access Trojan|RAT]], [[Keylogging]]
| membership =
| leader_name =
| language = [[Chinese language|Chinese]]
| parent_organization = [[Tianjin State Security Bureau]] of the [[Ministry of State Security (China)|Ministry of State Security]]
| affiliations =
| formerly = APT10 Stone Panda MenuPass RedLeaves CVNX POTASSIUM 
| website =
| remarks =
}}

'''Red Apollo''' (also known as '''APT 10''' (by [[Mandiant]]), '''MenuPass''' (by [[Fireeye]]), '''Stone Panda''' (by [[Crowdstrike]]), and '''POTASSIUM''' (by [[Microsoft]]))<ref>{{Cite web|title=APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat|url=https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html|access-date=2021-03-07|website=FireEye|language=en}}</ref><ref>{{Cite web|last=Kozy|first=Adam|date=2018-08-30|title=Two Birds, One STONE PANDA|url=https://www.crowdstrike.com/blog/two-birds-one-stone-panda/|access-date=2021-03-07|language=en-US}}</ref> is a [[People's Republic of China|Chinese]] state-sponsored [[cyberespionage]] group which has operated since 2006. In a 2018 indictment, the [[United States Department of Justice]] attributed the group to the [[Tianjin State Security Bureau]] of the [[Ministry of State Security (China)|Ministry of State Security]].<ref>{{Cite web|date=2018-12-20|title=Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information|url=https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion|url-status=live|access-date=2021-03-07|website=[[United States Department of Justice]]|language=en}}</ref>

The team was designated an Advanced Persistent Threat by Fireeye, who reported that they target aerospace, engineering, and telecom firms and any government that they believe is a rival of [[China]].

Fireeye stated that they could be targeting intellectual property from educational institutions such as a Japanese university and is likely to expand operations into the education sector in the jurisdictions of nations that are allied with the [[United States]].<ref name=":0">{{Cite web|date=April 6, 2017|title=APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat « APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat|url=https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html|url-status=live|website=FireEye}}</ref> Fireeye claimed that they were tracked since 2009, however because of the low-threat nature they had posed, they were not a priority. Fireeye now describes the group as "a threat to organizations worldwide."<ref name=":0" />

==Tactics==

The group directly targets managed information technology service providers (MSPs) using [[Remote Access Trojan|RAT]]. The general role of an MSP is to help manage a company's computer network. MSPs were often compromised by Poison Ivy, FakeMicrosoft, PlugX, ArtIEF, [[Graftor]], and ChChes, through the use of [[spear-phishing]] emails.<ref name=":1">{{Cite web|date=April 10, 2017|title=Operation Cloud Hopper: What You Need to Know - Security News - Trend Micro USA|url=https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-cloud-hopper-what-you-need-to-know|url-status=live|website=trendmicro.com}}</ref>

==History==

=== 2014 to 2017: Operation Cloud Hopper ===
Operation Cloud Hopper was an extensive attack and theft of information in 2017 directed at MSPs in the United Kingdom (U.K.), United States (U.S.), Japan, Canada, Brazil, France, Switzerland, Norway, Finland, Sweden, South Africa, India, Thailand, South Korea and Australia. The group used MSP's as intermediaries to acquire assets and trade secrets from MSP-client engineering, industrial manufacturing, retail, energy, pharmaceuticals, telecommunications, and government agencies.

Operation Cloud Hopper used over 70 variants of backdoors, [[malware]] and [[Trojan horse (computing)|trojans]]. These were delivered through spear-phishing emails. The attacks scheduled tasks or leveraged services/utilities to persist in [[Microsoft Windows]] systems even if the computer system was rebooted. It installed malware and hacking tools to access systems and steal data.<ref name=":1" />

=== 2016 US Navy personnel data ===
Hackers accessed records relating to 130,000 [[US Navy]] personnel (out of 330,000).<ref>{{Cite web|url=https://www.technologyreview.com/f/612655/chinese-hackers-allegedly-stole-data-of-more-than-100000-us-navy-personnel/|title=Chinese hackers allegedly stole data of more than 100,000 US Navy personnel|website=MIT Technology Review}}</ref> Under these actions the Navy decided to coordinate with [[Hewlett Packard Enterprise Services]], despite warnings being given prior to the breach.<ref>{{Cite web|url=https://www.bankinfosecurity.com/us-navy-sailor-data-accessed-by-unknown-individuals-a-9560|title=US Navy Sailor Data 'Accessed by Unknown Individuals'|website=bankinfosecurity.com}}</ref> All affected sailors were required to be notified.

=== 2018 Indictments ===
A 2018 Indictment showed evidence that CVNX was not the name of the group, but was the alias of one of two hackers. Both used four aliases each to make it appear as if more than five hackers had attacked.

=== Post-Indictment activities ===
In April 2019 APT10 targeted government and private organizations in the [[Philippines]].<ref>{{cite news |last1=Manantan |first1=Mark |title=The Cyber Dimension of the South China Sea Clashes |url=https://magazine.thediplomat.com/#/issues/-LnBlVlS_1DsiVyAVtMQ/read |access-date=5 September 2019 |agency=The Diplomat |issue=58 |publisher=The Diplomat |date=September 2019}}</ref>

In 2020 Symantec implicated Red Apollo in a series of attacks on targets in Japan.<ref>{{cite web |last1=Lyngaas |first1=Sean |title=Symantec implicates APT10 in sweeping hacking campaign against Japanese firms |url=https://www.cyberscoop.com/apt10-china-japan-intellectual-property-symantec/ |website=www.cyberscoop.com |date=17 November 2020 |publisher=Cyberscoop |access-date=19 November 2020}}</ref>

In March 2021, they targeted [[Bharat Biotech]] and the [[Serum Institute of India|Serum Institute of India (SII)]], the world's largest vaccine maker's intellectual property for [[data theft|exfiltration]].<ref>{{Cite news|last=N. Das|first=Krishna|date=1 March 2021|title=Chinese hacking group Red Apollo (APT10) had identified gaps and vulnerabilities in the IT infrastructure and supply chain software of Bharat Biotech and the Serum Institute of India (SII), the world's largest vaccine maker|work=[[Reuters]]|url=https://www.reuters.com/article/health-coronavirus-india-china-idUSKCN2AT21O|url-status=live|access-date=1 March 2021}}</ref>

==See also==
*[[China–United States relations]]
*[[Cyberwarfare by China]]

==References==
{{reflist}}

{{Hacking in the 2010s}}
{{MSS}}
[[Category:Cyberespionage units of the Ministry of State Security (China)]]
[[Category:Chinese advanced persistent threat groups]]
[[Category:Cyberwarfare by China]]
[[Category:Hacker groups]]
[[Category:Hacking in the 2000s]]
[[Category:Hacking in the 2010s]]
[[Category:Information technology in China]]
[[Category:Military units and formations established in the 2000s]]
[[Category:Cybercrime in India]]

Red Apollo - Revision history

Ajay Kumar: Created a new article