File · APT10 · Nation-state · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06
APT10
- STONE PANDA
- Menupass Team
- happyyongzi
- POTASSIUM
- Red Apollo
- CVNX
- HOGFISH
- Cloud Hopper
state sponsor · ChinaMITRE G0045 ↗
attack rose · 46 techniques across 10 tactics
What changed
ledger · newest first- —todaynew CVE1 new CVE: CVE-2012-0158
Analyst brief
misp-galaxy + mitre-attackmenuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.
Observed targets (as stated by the sources)
15 countries · 2 sectorsassessed origin · Chinaobserved targets · 15
countries · 15
- Japan
- India
- South Africa
- South Korea
- Sweden
- United States
- Canada
- Australia
- France
- Finland
- United Kingdom
- Brazil
- Thailand
- Switzerland
- Norway
sectors · 2
- Private sector
- Government
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique46 techniques · 10 of 15 tactics
Resource development
2 techniquesInitial access
3 techniquesExecution
6 techniquesStealth
11 techniquesDefense impairment
1 techniqueCredential access
3 techniquesDiscovery
6 techniquesLateral movement
3 techniquesCollection
8 techniquesCommand and control
3 techniques
select a technique
Arsenal
13 malware · 12 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs APT10 is cited as exploiting
none on KEV- CVE-2012-01582026-10-17
“We found Stone Panda Poison Ivy samples delivered with the same CVE-2012-0158 exploits, dropping iph.bat and iExplorer.exe”
cited as exploiting · source: media.kasperskycontenthub.com ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hostedTake it with you
keyless · no signupReferences
25 sources- 1.unit42.paloaltonetworks.com/unit42-menupass-returns-new-malware-new-attacks-japane…
- 2.cfr.org/interactive/cyber-operations/apt-10
- 3.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20re…
- 4.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf
- 5.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html
- 6.eweek.com/security/chinese-nation-state-hackers-target-u.s-in-op…
- 7.blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-cyber-espi…
- 8.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-…
- 9.us-cert.gov/sites/default/files/publications/IR-ALERT-MED-17-093-0…
- 10.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-…
- +15 more in the JSON record
Track APT10 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.