APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign

Recorded Future and Rapid7 detail a sustained APT10 (Chinese state-sponsored) cyberespionage campaign against a Norwegian MSP (Visma), a U.S. law firm, and an international apparel company between late 2017 and 2018; attackers used stolen Citrix/remote-access credentials, DLL sideloading to deploy Trochilus and UPPERCUT implants, Mimikatz to harvest credentials and NTDS.DIT, and exfiltrated proprietary data to Dropbox — the report includes full malware analysis, IoCs (IPs, domains, hashes, filenames), timeline, attribution evidence, and mitigation guidance.