APT10__2018__msp_investigation_report.pdf

The Australian Cyber Security Centre investigated a 2016–2017 compromise of a multinational construction services company's Australian arm via a legitimately provisioned MSP account; the actor (linked to APT10/Operation Cloud Hopper) installed PlugX and later RedLeaves RATs, collected Active Directory data (including an NTDS export), used Mimikatz, maintained persistence across domain controllers and exfiltrated commercial data, with the report providing technical findings and mitigation guidance.