iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Recorded Future research reported that APT10-linked activity affected Norwegian managed service provider Visma, an unnamed U.S. law firm and an unnamed international apparel company between November 2017 and September 2018. The reported methods included stolen credentials for remote access, credential theft and malware. Researchers assessed that the Visma intrusion may have been intended to reach its customers, while the other two incidents likely sought commercial intelligence. Those motives are assessments, not confirmed statements from the attackers.
What happened in the reported APT10 attacks?
SecurityWeek reported on February 6, 2019, on Recorded Future research describing activity against at least three organizations over a period from November 2017 through September 2018. The law firm was targeted first, in late 2017; the apparel company was targeted a few months later; and the Visma intrusion was reported in August 2018. The report did not name the law firm or the apparel company, and their identities should not be inferred.
The report linked different malware to the incidents: Trochilus was identified in the Visma intrusion, while UPPERCUT, also called ANEL, was reported in the law-firm and apparel-company incidents. The account describes Dropbox use for exfiltration in all three incidents. It also says cURL for Windows was used to move data out in the Visma and law-firm incidents. SecurityWeek’s report on the Recorded Future findings is the source for these incident details.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →How did the attackers reportedly get in and operate?
Recorded Future’s account describes attackers using valid but stolen credentials to access remote systems through Citrix and LogMeIn software. The reported sequence also included DLL sideloading, which can cause a legitimate program to load a malicious library, and Mimikatz, a tool used to harvest credentials. BITSAdmin scheduled tasks were reportedly used to transfer tools from command-and-control infrastructure.
#1 Best Overall
In the Visma incident, the modified Trochilus version reportedly used both RC4 and Salsa20 to encrypt command-and-control traffic; earlier versions were described as using RC4 alone. These details come from the researchers’ account of the observed incidents, not a general statement about every APT10 operation or every version of the malware.
Why target a managed service provider?
Visma is a managed service provider (MSP): an organization that remotely manages information-technology systems for customers. Recorded Future assessed that the Visma intrusion was likely aimed at enabling secondary access to customer networks, rather than stealing Visma’s own intellectual property. In contrast, the researchers assessed the law-firm and apparel-company incidents as likely seeking information for commercial advantage. These are inferred objectives, not verified motives.
The broader strategic context appears in a 2018 U.S. indictment, which alleges that APT10 actors targeted MSPs because their remote administration access could provide a route into clients’ networks and to intellectual property or confidential business information. That indictment describes a wider alleged campaign; it does not establish that every detail of that campaign occurred in the Visma incident. The U.S. Department of Justice indictment sets out those broader allegations.
| Target type | Organization in the report | Researchers’ assessment of likely objective |
|---|---|---|
| Direct commercial target | Unnamed U.S. law firm and unnamed international apparel company | Information that could provide commercial advantage |
| Managed service provider | Visma, Norway | Potential access to customer networks, rather than Visma’s own intellectual property |
The objective column reflects Recorded Future’s assessment as reported by SecurityWeek; it is not proof of attacker intent.
Rank #3
What did the indictment and government attribution establish?
The indictment is a charging document, not a finding of guilt. It alleges that Zhu Hua and Zhang Shilong were APT10 members, worked for a Tianjin technology company and acted in association with China’s Ministry of State Security through its Tianjin State Security Bureau. It also alleges separate technology-theft and MSP-theft campaigns. These allegations should not be treated as convictions or as a court determination that the defendants committed the conduct described.
In December 2018, SecurityWeek reported that the United States, United Kingdom, Canada, Australia and New Zealand had publicly blamed China for APT10 attacks. Government attribution is distinct from both the indictment’s allegations and Recorded Future’s analysis of the three incidents; it is not a judicial finding specifically about the Visma intrusion. SecurityWeek’s account of the Five Eyes governments’ attribution summarizes that public action.
The indictment also alleges that a broader APT10 technology-theft campaign accessed more than 45 entities across at least 12 U.S. states and stole hundreds of gigabytes of sensitive data. Those are allegations about the broader campaign, not statistics describing the three organizations in the 2017–2018 incident report.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Best Value
What the report does—and does not—tell readers
- It describes at least three affected organizations and a specific historical period, November 2017 through September 2018.
- It does not identify the U.S. law firm or the apparel company.
- It reports observed techniques and malware for these incidents, while the reasons for targeting each organization remain researchers’ assessments.
- It does not establish APT10’s current activity or the current security status of Citrix, LogMeIn, Dropbox, or any named tool.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
