Menu

Individual skill

apt10-stone-panda

Adversary-emulation profile for APT10 (G0045 / Stone Panda / menuPass / POTASSIUM / Red Apollo / CVNX), China's MSS Tianjin State Security Bureau cyber-espionage actor.

packages/decepticon/decepticon/skills/shared/adversary-emulation/apt10-stone-panda/SKILL.md

Read pinned source

Source commit cc6044561ff32188dc0aa899bcc7d3666ffcfd1c

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 2, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
6,563
Repository last updated
Nov 7, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Declared tags are partial or unavailable.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# APT10 (Stone Panda, menuPass, POTASSIUM, Red Apollo) — Adversary Emulation Profile

APT10 (MITRE ATT&CK **G0045**) is a long-running Chinese cyber-espionage group active since at least 2006, attributed to China's Ministry of State Security (MSS) **Tianjin State Security Bureau**. Individual members have been identified as working for the Huaying Haitai Science and Technology Development Company. APT10 is best known for **Operation Cloud Hopper** — the systematic, large-scale compromise of managed IT service providers (MSPs) to pivot into hundreds of downstream client organizations worldwide — a paradigm-defining supply-chain attack. The group's toolkit spans custom implants (PlugX, RedLeaves, ChChes, UPPERCUT/ANEL, SodaMaster, Ecipekac), public frameworks (QuasarRAT, Cobalt Strike, Mimikatz, PsExec), and heavy reliance on DLL side-loading for evasion. Targeting is broad: healthcare, defense, aerospace, government, telecom, maritime, finance, and biotechnology, with a persistent emphasis on Japanese organizations and Western MSPs.

## Attribution & motivation

- **Sponsor / nation:** People's Republic of China — Ministry of State Security (MSS), **Tianjin State Security Bureau**. The December 2018 U.S. DOJ indictment named two MSS-linked operatives, **Zhu Hua (朱华)** and **Zhang Shilong (张士龙)**, as APT10 members employed by Huaying Haitai Science and Technology Development Company. Joint attributions by the UK (NCSC), Japan, Australia, Canada, and the EU corroborated the MSS link.
- **Motivation:** Primarily **economic espionage and intellectual-property theft** aligned with Chinese state industrial policy — stealing trade secrets, engineering data, and business-confidential information from technology, aerospace, defense, pharmaceutical, and energy sectors. Secondary motivation includes **strategic intelligence collection** (government, diplomatic, and telecom surveillance — e.g., Call Detail Records in Operation Soft Cell).
- **Attribution confidence:** **High.** Backed by U.S. DOJ criminal indictments (SDNY, Dec 2018), coordinated Five Eyes + EU government attributions, and consistent named vendor reporting (FireEye/Mandiant, PwC/BAE Systems, Symantec, Kaspersky, Palo Alto Unit 42, Cybereason, Accenture).

## Targeting

- **Sectors:** IT managed service providers (MSPs) and cloud service providers (the defining target); healthcare; defense and aerospace; government and public administration; telecommunications; finance and banking; maritime; biotechnology and pharmaceuticals; energy; manufacturing and mining; academia and research.
- **Regions:** Heavy emphasis on **Japan** (persistent, long-running campaigns against government agencies and corporations); **United States** (MSPs, technology, government); **Western Europe** (UK, Germany, France, Nordics — via MSP pivots); broader global reach through the MSP supply chain into dozens of countries. Operation Soft Cell targeted telcos across Southeast Asia, Europe, Africa, and the Middle East.