APT10__2017__cloud-hopper-annex-b-final.pdf

Operation Cloud Hopper — Technical Annex (April 2017) provides detailed technical analysis of APT10’s tooling, malware families (EvilGrab, ChChes, RedLeaves, Poison Ivy, PlugX, Quasar), repurposed scripts and post‑exploit tools, and associated C2 infrastructure and IOCs; it documents spear‑phishing delivery, MSP supply‑chain targeting, credential theft, lateral movement and data exfiltration techniques and includes defensive recommendations.