APT10__2017__cloud-hopper-report-final-upda_72977.pdf

This PwC/BAE Systems report exposes Operation Cloud Hopper, a large-scale APT10 campaign that targeted managed IT service providers to gain broad access to client networks and exfiltrate sensitive IP; it also documents a parallel Japan-focused campaign using ChChes. The report includes timelines, malware families (Poison Ivy, PlugX, ChChes, Quasar, RedLeaves), detailed TTPs (spearphishing, credential theft, RDP/Robocopy/PSCP exfiltration), dynamic-DNS C2 infrastructure and IOCs, and assesses APT10 as a highly capable China-aligned espionage actor.