ChinaAttributedMSS Tianjin bureauEspionageActive 2006 – 2022Stone Panda
Also known asCicada · MenuPass · Bronze Riverside · MenuPass Team · Red Apollo · CVNX · POTASSIUM · Hogfish · TA429 · Happyyongzi · CTG-5938 · ATK 41 · ITG01 · Granite Taurus · Cuckoo Spear · Purple Typhoon
Summary
MSS Tianjin State Security Bureau-linked espionage group (APT10, menuPass, Cicada, Purple Typhoon). Its defining operation, Cloud Hopper, compromised managed service providers from about 2014 to reach their clients' networks worldwide; DOJ charged two members in Dec 2018 and the US, UK, Japan, Australia and EU attributed it jointly. Symantec's Cicada campaign (mid-2021 → Feb 2022) hit government, NGO, religious, telecom and legal organisations across several continents with custom loaders and the Sodamaster backdoor. MirrorFace (Earth Kasha), which MITRE and ESET place under the APT10 umbrella, is tracked as its own record and carries the 2019–2025 campaigns against Japan and Europe.
Attribution
Tianjin State Security Bureau
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- US Department of Justice (Government, 2018-12-20)
Two hackers associated with the MSS charged for the APT10 intrusion campaign - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Members acted for the MSS Tianjin State Security Bureau
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Cicada — government, NGO, telecom and legal targets worldwide (custom loader, Sodamaster) | 2021 – 2022-02 | Global, USA, Japan, Europe, Asia | Government, NGO, Religious, Telecommunications, Legal | Symantec (2022-04-05) |
| Cloud Hopper — managed-service-provider compromise to reach client networks | 2014 – 2018 | Global, USA, Japan, UK, EU | Managed Service Providers, Technology, Telecommunications, Financial Services, Manufacturing, Healthcare, Mining | US DOJ (2018-12-20) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 11
| Initial Access1 | T1199Trusted Relationship |
|---|---|
| Persistence1 | T1078Valid Accounts |
| Stealth5 | T1055Process InjectionT1218.004InstallUtilT1036.003Rename Legitimate UtilitiesT1055.012Process HollowingT1070.003Clear Command History |
| Credential Access1 | T1003OS Credential Dumping |
| Collection1 | T1039Data from Network Shared Drive |
| Exfiltration1 | T1048Exfiltration Over Alternative Protocol |
| Command and Control1 | T1568.001Fast Flux DNS |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| PlugX | Modular RAT | Windows |
| QuasarRAT | Open-source RAT | Windows |
| RedLeaves | Backdoor | Windows |
| ANEL (UPPERCUT) | Backdoor | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2020-1472 | 10 | Windows Netlogon "ZeroLogon" — privilege escalation (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Dynamic DNS for its domains; a service provider's IP used to proxy victim C2 (MITRE ATT&CK, 2026)