Threat Intelligence Tarot
swords · 1
China (MSS - Tianjin Bureau)
G0045★★★★★
risk 4/5
✦ The Thousand Hands ✦
APT10
Stone Panda · MenuPass · POTASSIUM · Cicada
MSPsHealthcareDefenseFinanceManufacturing26+ countries
Active since ~2009 · Intellectual property theft, Managed service provider compromise, Supply chain espionage
It does not attack companies. It attacks the companies that manage companies. One managed service provider, patiently owned, becomes a skeleton key to a hundred client networks. The Thousand Hands reaches everywhere without touching anything directly.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Operation Cloud Hopper - global MSP compromise (2016–2017)
- ◆ANEL and PlugX malware deployments
- ◆US, UK, Australia, Canada, Japan advisory (2018)
- ◆Targeted 45+ companies across 12 countries via single MSP campaign
Defenses
- ▸Third-party and MSP access segmentation and least-privilegeCIS Control 6 ↗
- ▸MFA enforcement on all remote access including vendor accountsNIST SP 800-63B ↗
- ▸Supply chain risk management programNIST CSF: ID.SC ↗
- ▸Behavioral anomaly detection on privileged accountsNIST CSF: DE.AE ↗
Reversed: Their Weakness
Cloud Hopper's exposure came when security researchers noticed identical malware families and C2 infrastructure across seemingly unrelated victim networks - the pattern of the MSP pivot, once seen, could not be unseen.
Share this adversary profile
swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.