APT GroupHigh for the historical APT10/menuPass identity and cited campaign behaviors; attribution of any current SOGU/PlugX incident requires case-specific evidence because the malware family is used by multiple operators. confidenceSynced actor recordProfile updated 2026-08-06T16:00:00.000Z

Stone Panda

Historical public reporting connects APT10/menuPass to credential theft, managed-service-provider and downstream-client access, DLL side-loading, PlugX-family tooling, and Japan-linked espionage. These actor links provide context but do not attribute every SOGU or PlugX-family intrusion.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type^1,2

APT Group profile

First Seen^1,2

2006-01-01

Last Seen^1,2

2025-07-16

Profile Updated^1,2

2026-08-06T16:00:00.000Z

Victim Count¹

Not available

Origin^1,2

Unknown

Motivation^1,2

Information theft and espionage

Primary Access Pattern^1,2

T1078 Valid Accounts

Objective^1,2

Information theft and espionage

Identity

Aliases And Boundaries

Aliases^1,2

APT10menuPassCicadaCloud HopperRed ApolloATK41BRONZE RIVERSIDECVNXG0045Granite TaurusHOGFISHMenupass TeamPOTASSIUMPurple TyphoonTA429happyyongziAPT 10Stone Panda

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

Not available

Target Sectors¹

Managed Service ProvidersTechnologyGovernmentHealthcareEnergyCommunicationsManufacturingProfessional ServicesJapan-linked organizationsEnergy & UtilitiesFinanceHealthCare & Social AssistanceOtherPublic AdministrationChemical&Pharmaceutical ManufacturingElectrical&Electronical ManufacturingTelecommunicationsSpace & DefenseNational Security&International AffairsConstruction of BuildingsOil & GasEducational ServicesInternet PublishingInsuranceMotor Vehicle ManufacturingPerforming Arts CompaniesOther Amusement and Recreation IndustriesGrantmaking and Giving ServicesCivic and Social OrganizationsComputer Systems Design and Related ServicesInformation ServicesOffices of LawyersComputer Systems Design Services

Associated Activity^1,2

Stolen privileged credentials or certificatesUnexpected managed-service-provider to client accessLegitimate executable plus unexpected adjacent DLL and encoded payloadMemory-resident PlugX/SOGU evidenceUnexpected scheduled-task or Windows-service persistencePrivileged VPN, RDP, SMB, or admin-share activity inconsistent with baselineInitial Access: Spear-phishing emails containing malicious attachments (e.g., .lnk files, documents with double extensions) or links to compromised websites.Initial Access: Exploitation of vulnerabilities in public-facing applications, such as Pulse Secure VPNs or ZeroLogon (CVE-2020-1472), to gain initial access.Initial Access: Compromise of Managed Service Providers (MSPs) to gain indirect access to client networks.Execution & Persistence: Deployment of custom malware including RedLeaves RAT, QuasarRAT, PlugX, ChChes, LODEINFO, SOGU, SigLoader, and SodaMaster.Execution & Persistence: Use of web shells, such as Jackpot, for persistent access and remote control.Defense Evasion: DLL sideloading to load malicious payloads like Mimikatz and PwDump6.Defense Evasion: Renaming and relocating legitimate tools (e.g., certutil) to bypass detection.Defense Evasion: Clearing PowerShell execution logs using `wevtutil`.Credential Access: Use of tools like Mimikatz, Impacket, wmiexec.vbs, secretsdump.py, and Ntdsutil for credential harvesting.Lateral Movement: Use of PsExec and exploitation of compromised MSP networks for lateral movement.Collection & Exfiltration: Staging data in multi-part archives (TAR, RAR), often in the Recycle Bin, prior to exfiltration.Command and Control: Communication with command and control (C2) servers via compromised sites or dynamic DNS domains.Impact: Large-scale intellectual property theft and exfiltration of sensitive government and corporate data.HAYMAKER, SNUGRIDE, BUGJUICE, QUASARRATThis recent APT10 activity has included both traditional spear phishing and access to victim’s networks through managed service providers. (For more information on infection using service providers see M-Trends 2016.) APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (for example, [Redacted]_Group_Meeting_Document_20170222_doc_.exe) and in some cases simply identically named decoy documents and malicious launchers within the same archive. In addition to the spear phishes, Mandiant Threat Intelligence has observed APT10 accessing victims through global service providers.This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through managed service providers. (For more information on infection through service providers see M-Trends 2016.) APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (for example, [Redacted]_Group_Meeting_Document_20170222_doc_.exe) and in some cases simply identically named decoy documents and malicious launchers within the same archive. In addition to the spear phishes, Mandiant Threat Intelligence has observed APT10 accessing victims through global service providers.

ATT&CK IDs^1,2

T1078 Valid AccountsT1199 Trusted RelationshipT1574.001 DLL Search Order HijackingT1620 Reflective Code LoadingT1021 Remote ServicesT1003 OS Credential DumpingT1053.005 Scheduled Task/Job: Scheduled TaskT1543.003 Create or Modify System Process: Windows ServiceT1003 - OS Credential DumpingT1003.002T1003.003T1003.004T1005T1011 - Exfiltration Over Other Network MediumT1012 - Query RegistryT1016T1018T1021T1021.001 - Remote Desktop ProtocolT1021.002 - SMB/Windows Admin SharesT1021.004T1027 - Obfuscated Files or InformationT1027.002 - Software PackingT1027.004 - Compile After DeliveryT1027.013T1030T1036 - MasqueradingT1036.003T1036.005T1039T1045 - Software PackingT1046T1047 - Windows Management InstrumentationT1049T1053 - Scheduled Task/JobT1053.005 - Scheduled TaskT1055 - Process InjectionT1055.012T1056 - Input CaptureT1056.001 - KeyloggingT1057 - Process DiscoveryT1059 - Command and Scripting InterpreterT1059.001 - PowerShellT1059.003 - Windows Command ShellT1059.005 - Visual BasicT1060 - Registry Run Keys / Startup FolderT1068 - Exploitation for Privilege EscalationT1069 - Permission Groups DiscoveryT1069.002 - Domain GroupsT1070 - Indicator Removal on HostT1070.003T1070.004T1071 - Application Layer ProtocolT1071.001 - Web ProtocolsT1071.004 - DNST1072 - Software Deployment ToolsT1074T1074.001T1074.002T1078 - Valid AccountsT1082 - System Information DiscoveryT1083 - File and Directory DiscoveryT1087 - Account DiscoveryT1087.002T1090T1090.002T1095T1102 - Web ServiceT1104 - Multi-Stage ChannelsT1105 - Ingress Tool TransferT1106 - Native APIT1112 - Modify RegistryT1113 - Screen CaptureT1115 - Clipboard DataT1119 - Automated CollectionT1123T1124T1127 - Trusted Developer Utilities Proxy ExecutionT1129 - Shared ModulesT1132 - Data EncodingT1133 - External Remote ServicesT1134 - Access Token ManipulationT1136 - Create AccountT1137T1140 - Deobfuscate/Decode Files or InformationT1143 - Hidden WindowT1158 - Hidden Files and DirectoriesT1176T1189T1190 - Exploit Public-Facing ApplicationT1192T1194T1195T1199T1204 - User ExecutionT1204.002 - Malicious FileT1210 - Exploitation of Remote ServicesT1213.001T1218T1218.004T1219 - Remote Access SoftwareT1449 - Exploit SS7 to Redirect Phone Calls/SMST1474 - Supply Chain CompromiseT1480 - Execution GuardrailsT1497 - Virtualization/Sandbox EvasionT1518 - Software DiscoveryT1543 - Create or Modify System ProcessT1543.003 - Windows ServiceT1546 - Event Triggered ExecutionT1547 - Boot or Logon Autostart ExecutionT1548.002 - Bypass User Account ControlT1552 - Unsecured CredentialsT1553 - Subvert Trust ControlsT1553.002T1558 - Steal or Forge Kerberos TicketsT1560 - Archive Collected DataT1560.001T1562 - Impair DefensesT1566 - PhishingT1566.001T1566.002 - Spearphishing LinkT1568 - Dynamic ResolutionT1568.001T1568.002 - Domain Generation AlgorithmsT1569 - System ServicesT1570 - Lateral Tool TransferT1571T1573 - Encrypted ChannelT1573.002 - Asymmetric CryptographyT1574 - Hijack Execution FlowT1574.001T1574.002T1574.006 - Dynamic Linker HijackingT1583 - Acquire InfrastructureT1583.001 - DomainsT1583.005 - BotnetT1587.001T1588T1588.001T1588.002T1590 - Gather Victim Network InformationT1591 - Gather Victim Org InformationT1608.001TA0011 - Command and ControlTA0037 - Command and Control

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 7675¹IntelliOS retained 33^2,10

SOCRadar reports 7675 IOCs for this profile. IntelliOS currently retains 33 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 3 source groups tracked; 2 currently contribute retained observable or context rows.

Retained Observables

Showing 33 of 33

Type	Value	Source
SHA-256 Hash	01b610e8ffcb8fd85f2d682b8a364cad2033c8104014df83988bc3ddfac8e6ec¹⁰	Symantec/Broadcom
SHA-256 Hash	056c0628be2435f2b2031b3287726eac38c94d1e7f7aa986969baa09468043b1¹⁰	Symantec/Broadcom
SHA-256 Hash	062ce400f522f90909ed5c4783c5e9c60b63c09272e2ddde3d13e748a528fa88¹⁰	Symantec/Broadcom
SHA-256 Hash	0b452f7051a74a1d4a544c0004b121635c15f80122dc6be54db660ceb2264d6f¹⁰	Symantec/Broadcom
SHA-256 Hash	0ec48b297dd1b0d6c3ddd15ab63f405191d7a849049feedfa7e44096c6f9d42a¹⁰	Symantec/Broadcom
SHA-256 Hash	20fc3cf1afcad9e6f19e9abebfc9daf374909801d874c3d276b913f12d6230ec¹⁰	Symantec/Broadcom
SHA-256 Hash	2317d3e14ab214f06ae38a729524646971e21b398eda15cc9deb8b00b231abc3¹⁰	Symantec/Broadcom
SHA-256 Hash	2417da3adebd446b9fcb8b896adb14ea495a4d923e3655e5033f78d8e648fcc8¹⁰	Symantec/Broadcom
SHA-256 Hash	37f56127226ce96af501c8d805e76156ca6b87da1ba1bb5d227100912f6c52d9¹⁰	Symantec/Broadcom
SHA-256 Hash	3aa54e7d99b69a81c8b25ab57aeb971644ed0a206743c9e51a80ec1852f03663¹⁰	Symantec/Broadcom
SHA-256 Hash	3ff2d6954a6b62afb7499e1e317af64502570181fd49ac5a74e2f7947e2e89db¹⁰	Symantec/Broadcom
SHA-256 Hash	4f6a768841595293146ca04f879efa988e4e95ce0f2bc299cb669fea55e78b65¹⁰	Symantec/Broadcom
SHA-256 Hash	5269db6b19a1d758c75e58ee9bbf2f8fd684cfedbfe712d5b0182d7bbd3a1690¹⁰	Symantec/Broadcom
SHA-256 Hash	5bc68df582c86c884b563b15057cc223f2e9bc1022ebb297e32a9a7e3036228b¹⁰	Symantec/Broadcom
SHA-256 Hash	6b4692029f05489ecda10e11cfacfc3b19097856b88647d3695f3bdc7dd83ce9¹⁰	Symantec/Broadcom
SHA-256 Hash	7b581c0305c78f28bad60028c63e852dc34fc9e28f39e4b0af73d80c1d9680c9¹⁰	Symantec/Broadcom
SHA-256 Hash	83030f299a776114878bcd2ade585d97836ef4ddb6943cb796be2c88bcb83a83¹⁰	Symantec/Broadcom
SHA-256 Hash	90a03dabfc4e56a12cc3bac5cbe991db044b900a01ec341803c864506e467ffa¹⁰	Symantec/Broadcom
SHA-256 Hash	9917a2213f114e87745867e5fea6717efd727d7c08fdc851969224be2f0e019b¹⁰	Symantec/Broadcom
SHA-256 Hash	9b5f9ff82ed238bcbd83628ed3ec84988dc05f81cec9e45a512fbd2c8ac45c33¹⁰	Symantec/Broadcom
SHA-256 Hash	adfe177ade7d9bfe4df251a69678102aec1104a4ba9f73032dd90aba76d8bdd9¹⁰	Symantec/Broadcom
SHA-256 Hash	b76fde584f87c88bdd21fab613335ce7fc05788aa4bb3191d1517ec16ef4d11a¹⁰	Symantec/Broadcom
SHA-256 Hash	ce45af43dd2af52d6034e981515474147802efdfe036e00078fee29a01694fd6¹⁰	Symantec/Broadcom
SHA-256 Hash	d461347388ccf0c2008332a1674885a41f70b94b2263bddef44e796d3b1b43b5¹⁰	Symantec/Broadcom
SHA-256 Hash	df993dca434c3cd2da94b6a90b0ae1650d9c95ea1d5f6a5267aca640d8c6d00e¹⁰	Symantec/Broadcom
SHA-256 Hash	ee46e714660f7652502d5b3633fae0c08c8018f51cfb56a487afd58d04dd551a¹⁰	Symantec/Broadcom
SHA-256 Hash	fe33fdd5a63fee62362c9db329dde11080a0152e513ef0e6f680286a6a7b243f¹⁰	Symantec/Broadcom
Tool / Process	ChChes²	MITRE
Tool / Process	Haymaker²	MITRE
Tool / Process	QuasarRAT²	MITRE
Tool / Process	RedLeaves²	MITRE
Tool / Process	SOGU²	MITRE
Campaign Context	Symantec/Broadcom reported Cicada/APT10 activity against NGOs and government organizations and retained public sample hashes for defensive scoping.¹⁰	Symantec/Broadcom

Source	Reported	Retained	Coverage Status
SOCRadar¹	7675	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
MITRE ATT&CK²	N/A	5	Public observables or source-context rows retained and displayed.
Symantec/Broadcom¹⁰	N/A	28	Public observables or source-context rows retained and displayed.

IntelliOS Intel Products

Linked Products

PANDA Flash Threat Intel Brief

SOGU Flash Threat Brief

Source-backed investigation and response brief for credential- and provider-trust-led access, DLL side-loading, memory collection, and proof criteria.

CARDS Campaign

PLUGX/SOGU Multi-Victim Intrusions

Campaign record with explicit attribution and CVE relationship boundaries.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Stone Panda	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Stone Panda	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Baseline actor-card corpus source for retained profile fields.
2	MITRE ATT&CK https://attack.mitre.org/groups/G0045/	Canonical ATT&CK group, campaign, software, aliases, and technique mapping source where matched.
3	MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json	Open MITRE CTI source used for ATT&CK enrichment.
4	SOGU Flash Threat Brief /vault/sogu-plugx-remote-access-malware	IntelliOS Flash Threat Brief
5	PLUGX/SOGU Multi-Victim Intrusions /threat-actor-cards/campaigns/plugx-sogu-multi-victim-intrusions	CARDS Campaign
6	CISA multi-victim intrusion alert https://www.cisa.gov/sites/default/files/publications/IR-ALERT-MED-17-093-01C-Intrusions_Affecting_Multiple_Victims_Across_Multiple_Sectors.pdf	Government Alert
7	DOJ: APT10 global intrusion campaigns https://www.justice.gov/usao-sdny/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer	Government Attribution
8	Symantec: Cicada/APT10 Japan-linked campaign https://www.security.com/threat-intelligence/cicada-apt10-japan-espionage	Primary Campaign Research
9	Google/Mandiant APT profile: APT 10 https://cloud.google.com/security/resources/insights/apt-groups	Vendor Enrichment
10	Symantec/Broadcom: Cicada/APT10 China NGO and Government Attacks https://www.security.com/threat-intelligence/cicada-apt10-china-ngo-government-attacks	Vendor Research

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Stone Panda.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards