Cloud Hopper / APT10 Managed Service Provider Campaign
Active circa 2014 – publicly disclosed April 2017; indictment December 2018
Executive Summary
Multi-year campaign of intrusions against managed IT service providers (MSPs) in at least a dozen countries, pivoting through MSP credentials and infrastructure to reach the providers' downstream client networks. PwC UK, BAE Systems, and the UK NCSC publicly disclosed the campaign as Operation Cloud Hopper in April 2017, attributing it to APT10 (a.k.a. Stone Panda, MenuPass). The US Department of Justice indicted two PRC nationals, Zhu Hua and Zhang Shilong, alleged to be acting in association with the Ministry of State Security's Tianjin State Security Bureau, on 20 December 2018, in coordination with allied public-naming statements from the UK, Australia, Canada, New Zealand, Japan, Germany, and the Netherlands. The indictment was not accompanied by US sanctions at the time of filing.
Why This Matters
Cloud Hopper is the strongest pre-2024 data point on the indictment-without-sanctions cell at allied scale. It shows that even a broadly coordinated Five-Eyes-plus public-naming exercise against a PRC MSS contractor model did not, in 2018, escalate to OFAC sanctions. Read forward to Salt Typhoon (Jan 2025 OFAC sanctions on a comparable PRC contractor), it provides the time-series evidence that the consequence baseline for China-attributed espionage shifted in the 2024–2025 window, and that the shift was a political choice rather than a response to new technical facts.
Escalation Profile
7-Dimension Profile
Escalation Ladder
Phases
MSP credential compromise
APT10 used spearphishing and credential abuse to compromise managed service providers, then leveraged the MSP-to-client trust relationship to pivot into hundreds of downstream organisations across multiple sectors and jurisdictions.
Public attribution by PwC, BAE Systems, and UK NCSC
Joint Operation Cloud Hopper report by PwC UK, BAE Systems, and the UK National Cyber Security Centre detailed the MSP-pivot tradecraft and attributed it to APT10.
Coordinated DOJ indictment and allied naming
US DOJ indicted Zhu Hua and Zhang Shilong (Dec 2018) in coordination with public-naming statements from the UK, Australia, Canada, New Zealand, Japan, Germany, and the Netherlands. Additional allied statements followed in early 2019 (Norway's NSM, others). No US sanctions were imposed in conjunction with the indictment.
Threshold Crossings
- •First public attribution of MSP-pivot tradecraft at global scale, demonstrating the systemic risk of concentrated managed-service trust relationships
- •First broadly coordinated allied public-naming statement against a PRC cyber espionage campaign (Five Eyes + Japan + Germany + Netherlands in December 2018, with additional statements in early 2019)
- •Reinforced the indictment-without-sanctions pattern previously established by APT1
Restraint Factors
- •Activity confined to intellectual-property and business-intelligence collection across MSP client networks; no destructive payload, no manipulation
- •Operators selected downstream targets selectively from MSP visibility rather than pursuing indiscriminate disruption
Attribution Assessment
Threat actor mapped to China based on infrastructure analysis, malware attribution, and operational patterns.
Evidence: PwC UK / BAE Systems / UK NCSC: 'Operation Cloud Hopper' joint report
- •Operation Cloud Hopper joint report by PwC UK, BAE Systems, and UK NCSC (Apr 2017)
- •US DOJ indictment of Zhu Hua and Zhang Shilong (Dec 2018)
- •Coordinated allied public-naming statements from Five Eyes, Japan, Germany, and the Netherlands (Dec 2018); additional allied statements followed in early 2019
- •No US sanctions issued in conjunction with the 2018 indictment, TODO: confirm subsequent Treasury actions touching APT10-linked entities for human review
Sources: US Department of Justice: Indictment of Zhu Hua and Zhang Shilong (S.D.N.Y.); US Department of Justice press release: 'Two Chinese Hackers Associated With the Ministry of State Security Charged With Global Computer Intrusion Campaigns'; UK Foreign and Commonwealth Office: 'UK and allies reveal global scale of Chinese cyber campaign'; Australian Government Joint Statement on Attribution of Malicious Cyber Activity
No dedicated journalistic sources in dataset. See sources section for full references.
“Confirmed” reflects available public evidence. All assessments carry inherent uncertainty and should be read alongside source material.
Unpeace Position
Unpeace Score
Composite severity rating on the peace–conflict spectrum
Contributing Dimensions
Coercive Function
Espionage
Intelligence collection, coercive value lies in the information advantage gained and the implicit signal that the adversary can access sensitive systems.
Observed coercive effects
- •First public attribution of MSP-pivot tradecraft at global scale, demonstrating the systemic risk of concentrated managed-service trust relationships
- •First broadly coordinated allied public-naming statement against a PRC cyber espionage campaign (Five Eyes + Japan + Germany + Netherlands in December 2018, with additional statements in early 2019)
- •Reinforced the indictment-without-sanctions pattern previously established by APT1
Entanglement Risk
Sectors affected
Countries / regions
Impact summary
MSP-pivot intrusions across at least a dozen jurisdictions enabling access to hundreds of downstream client networks; full scope of exfiltrated data not publicly enumerated.
Infrastructure Meaning
Malware / tooling
Capability profile
MSP-pivot intrusions across at least a dozen jurisdictions enabling access to hundreds of downstream client networks; full scope of exfiltrated data not publicly enumerated.
5 ATT&CK techniques mapped — see ATT&CK mapping below.
Governance Analysis
Governance Flags
Norms invoked
- •Obama–Xi 2015 understanding on cyber-enabled economic espionage; Cloud Hopper was cited as an indication that the understanding had not produced sustained behavioural change
- •UN GGE 2015 Norm 13(i) on supply-chain integrity (relevant by extension to MSP trust relationships)
- •State responsibility for contractor / MSS-affiliated operator activity (Tallinn Manual 2.0 Rule 4)
Policy responses
- •Operation Cloud Hopper joint report by PwC UK, BAE Systems, and UK NCSC (Apr 2017)
- •US DOJ indictment of Zhu Hua and Zhang Shilong (Dec 2018)
- •Coordinated allied public-naming statements from Five Eyes, Japan, Germany, and the Netherlands (Dec 2018); additional allied statements followed in early 2019
- •No US sanctions issued in conjunction with the 2018 indictment, TODO: confirm subsequent Treasury actions touching APT10-linked entities for human review
Regulatory changes
- •Catalysed CISA and NCSC guidance on MSP and third-party risk management
- •Informed subsequent US executive action on software-supply-chain security (e.g., EO 14028)
- •Renewed allied attention to MSS contractor model and the limits of indictment as enforcement
Governance impact assessment
Cloud Hopper reinforced the indictment-without-sanctions pattern at allied scale: the breadth of coordinated public-naming statements was unprecedented for a PRC cyber campaign in 2018, but no US sanctions accompanied the indictment. The case sits in the same governance band as APT1 and provides the temporal bridge to the Salt Typhoon / Flax Typhoon / Sichuan Silence sanctions wave of 2024–2025.
Sources
PwC UK / BAE Systems / UK NCSC: 'Operation Cloud Hopper' joint report
US Department of Justice: Indictment of Zhu Hua and Zhang Shilong (S.D.N.Y.)
US Department of Justice press release: 'Two Chinese Hackers Associated With the Ministry of State Security Charged With Global Computer Intrusion Campaigns'
UK Foreign and Commonwealth Office: 'UK and allies reveal global scale of Chinese cyber campaign'
Australian Government Joint Statement on Attribution of Malicious Cyber Activity
Sources listed reflect publicly available materials used to construct this case entry. Inclusion does not imply endorsement. Where no URL is provided, the source may be found via its title and date.
Related Cases
APT1
2006 – disclosed February 2013; indictment May 2014 · China
APT1 is the foundational test case for indictment-as-signal in cyber statecraft. It demonstrates that the United States is willing to publicly name uniformed foreign military personnel, but that this willingness does not, on its own, translate into sanctions or any other coercive consequence. Read alongside Sandworm (indictment plus sanctions) and Salt Typhoon (sanctions on PRC contractor), it shows that the indictment-to-sanctions step is a discretionary political choice, not an automatic escalation.
Exchange/Hafnium
January – March 2021 · China
Hafnium demonstrated how a targeted espionage operation can metastasize into a mass-compromise event affecting tens of thousands, and prompted the widest coalition cyber attribution ever directed at China.
Volt Typhoon
2023 – 2024 (disclosed 2024) · China
Volt Typhoon represents the clearest case of peacetime pre-positioning in adversary critical infrastructure, forcing an urgent policy reckoning on whether such activity constitutes a threat of force and how states should respond to it below the threshold of armed conflict.
Salt Typhoon
Access established earlier; disclosed September–December 2024 (note: investigation and disclosures ongoing as of May 2025) · China
Salt Typhoon is the temporal pivot of the matched-pair argument. It is structurally similar to Belgacom (a foreign state compromising another state's telecommunications backbone) but draws a sharply higher consequence, OFAC sanctions on a named contractor, because the perpetrator is positioned outside the Western attributing coalition. Read alongside Belgacom and OPM, it shows the consequence axis tracking political relationship rather than technical facts; read alongside Volt Typhoon, it shows that the relationship can move within a short time horizon (sanctions arrived for Salt Typhoon faster than for the parallel Volt Typhoon campaign).