Unmasking a global cyber espionage campaign

Setting the scene

For the last eight years, and possibly even longer, a global espionage campaign has been underway. Believed to be the work of a threat actor based in China and known to the security community as APT10, the campaign has seen a wide-ranging information collection spree conducted initially against the US defence industrial base and the technology and telecommunications sector, but now spreading to multiple industries and sectors worldwide.

Most recently, managed IT service providers (MSPs) have been under attack. And the campaign against them – known as Operation Cloud Hopper – has given APT10 unprecedented access to the intellectual property and sensitive data of MSPs and their clients across the globe.

How we helped

Since late 2016, PwC UK has been helping the victims of these attacks. PwC's threat intelligence team has been collaborating with other leading security research organisations and the UK's National Cyber Security Centre to track and research APT10’s actions, and PwC UK’s incident response team has been leading investigations into security compromises linked to APT10, and actively removing the attacker's access to victim organisations' systems and data.

The collaborative research uncovered important new information. It found that APT10 almost certainly benefits from significant staffing and logistical resources, which have been stepped up since 2016. It also found that APT10’s operations over the past two years have likely comprised multiple teams, each responsible for a different process – domain registration, infrastructure management, malware development, target operations and analysis.

The research also gave further weight to the belief that APT10 is a China-based threat actor, based on patterns within domain registrations and file compilation times. It showed how APT10 has been systematically targeting Japanese organisations using the bespoke malware called ‘ChChes’.