APT10 hackers targeting data
Joint campaign thwarts ‘new level’ cyber attack
Cyber security experts have worked together to thwart what is thought to have been one of the biggest espionage campaigns ever mounted.
Close collaboration between private sector companies and the UK’s National Cyber Security Centre (NCSC) led to identifying and disrupting a series of sophisticated cyber attacks.
The hackers, known as APT10, are said to have shown a new level and maturity of targeted attacks against the supply chain, compromising outsourced IT service providers to gain widespread access to thousands of organisations.
PwC’s cyber security practice worked with BAE Systems and other members of the security community, along with the NCSC to counter the attacks.
They believe the hacking group targeted providers of managed outsourced IT services as a way in to their customers’ organisations around the world, gaining unprecedented access to intellectual property and sensitive data.
This indirect approach of reaching many through only a few targets demonstrates a new level of maturity in cyber espionage. The sheer scale of the operation was only uncovered through collaboration, and is still only likely to reflect a small portion of APT10’s global operations.
Richard Horne, cyber security partner at PwC, said: “The future of cyber defence lies beyond simple intelligence sharing, but in forging true collaboration between organisations in the public and private sector with the deep technical and innovative skills required to combat this type of threat.
“This operation has demonstrated the importance of the recently established National Cyber Security Centre, set up for moments just like this.
“Operating alone, none of us would have joined the dots to uncover this new campaign of indirect attacks. Together we’ve been working to brief the global security community, managed service providers and known end victims to help prevent, detect and respond to these attacks.
“New forms of attack require new ways of working to defend our society. Close working collaboration is key.”
- Seen targeting managed service provider networks from 2016 onwards, and it is likely that this activity had begun as early as 2014
- Significantly increased its scale and capability since early 2016, adding new developers and intrusion operators to continually enhance their capability
- Focuses on espionage activity, targeting intellectual property and other sensitive data from a wide range of sectors and countries. The group is known to have exfiltrated a high volume of data from multiple victims and used compromised networks to stealthily move this data around the world
- A number of Japanese organisations have also been targeted directly in a separate, simultaneous campaign by the same group, with APT10 masquerading as legitimate Japanese government entities to gain access
Kris McConkey, partner, cyber threat detection and response at PwC, added: “The indirect approach of this attack highlights the need for organisations to have a comprehensive view of the threats they’re exposed to – including those of their supply chain.
“Alongside our research work, we have also notified the threat intelligence community and worked with the NCSC to notify managed service providers and known victims.
“This is a global campaign with the potential to affect a wide range of countries, so organisations around the world should work with their security teams and providers to check networks for the key warning signs of compromise and ensure they respond and protect themselves accordingly.”