Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
The indictment identifies the hackers as associated with the Chinese government, while the specific allegations are attributed to the US Department of Justice.
Attributed Confidence 98% · Rod Rosenstein EP 103 Details
“two hackers associated with the Chinese government”
Cloud Hopper ATTRIBUTED_TO APT10
The US Department of Justice indictment alleges that the defendants worked for a group known to cybersecurity experts as APT10.
Attributed Confidence 99% · Rod Rosenstein EP 103 Details
“The indictment alleges that the defendants work for a group known to cyber-security experts as APT10.”
Cloud Hopper COMPROMISES Domain controller
The attackers gained full administrator access to the customer’s domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they got into the domain controller of this network and had full admin access there”
Cloud Hopper COMPROMISES Managed Service Provider
The campaign compromised MSP infrastructure and used it to reach multiple customers.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
Mimikatz EXPLOITS Windows password handling flaw
Mimikatz extracts passwords from Windows memory where clear-text credentials may be cached.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“Windows has a major flaw in the way it handles passwords.”
“Mimikatz is a tool that goes to the exact spot in memory and grabs the password”
Cloud Hopper INITIAL_ACCESS_VIA Remote Desktop
The investigated server was initially accessed through Remote Desktop with a stolen MSP employee account.
Explicit Confidence 96% · Jack Rhysider EP 103 Details
“They logged into it and put the malware on.”
Cloud Hopper INVOLVES lateral movement
The attackers used stolen credentials to pivot and traverse to other systems, including the domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“started pivoting and traversing to other systems in the network”
Cloud Hopper INVOLVES Sabre
Reuters reportedly listed Sabre among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the travel reservation service Sabre”
Cloud Hopper INVOLVES keylogger
Keyloggers were found on MSP jump servers and could capture credentials for multiple customers.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“we know that they found key loggers on the jump servers at the MSP’s site”
Cloud Hopper INVOLVES jump server
A customer MSP jump server was compromised and communicated with command-and-control infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“this jump server that was reaching out to a known command and control server”
Cloud Hopper INVOLVES IBM
Reuters journalists reportedly identified IBM as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“they listed Hewlett Packard Enterprise, IBM, Fujitsu”
Cloud Hopper INVOLVES Hewlett Packard Enterprise
Reuters journalists reportedly identified Hewlett Packard Enterprise as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“seven different service providers were compromised, and they listed Hewlett Packard Enterprise”
Cloud Hopper INVOLVES Swedish Security Service
The campaign investigation began after the Swedish Security Service notified the victim about communications with a command-and-control server.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“they had been contacted by the Swedish Security Service because one of the systems had been talking to a command and control server”
Cloud Hopper INVOLVES Fujitsu
Reuters journalists reportedly identified Fujitsu as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“IBM, Fujitsu, TADA Consultancy”
Cloud Hopper INVOLVES network scanning
The attackers scanned public IP ranges, including ranges belonging to the US Department of Defense, for shared network drives.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“nineteen of those public IP ranges belonged to the US Department of Defense”
Cloud Hopper INVOLVES PlugX
The attackers later installed PlugX on the compromised server.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they brought in a known malware called PlugX”
Cloud Hopper INVOLVES Ericsson
Reuters reportedly listed Ericsson among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the telecom giant Ericsson”
Cloud Hopper INVOLVES credential dumping
After entering the network, the attackers ran Mimikatz to collect credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“it was then when Mimikatz was run where they grabbed all the credentials”
Cloud Hopper INVOLVES DLL side-loading
The attackers used DLL side-loading implants to execute malware through legitimate software binaries.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“We found three more instances of DLL side-loading implants”
Fabio Viggiani MEMBER_OF Truesec
Fabio Viggiani says he is an incident responder, threat analyst, and red teamer at Truesec.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“I’m an incident responder, threat analyst, and red teamer at Truesec.”
APT10 TARGETS United States Navy
The US attorney said APT10 hacking campaigns targeted the US Navy and stole personal information from over 100,000 Navy personnel.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“The defendant’s hacking campaigns also targeted US government agencies”
“from over 100,000 Navy personnel”
Cloud Hopper TARGETS United States Department of Defense
The campaign scanned DoD address ranges and was ultimately associated with efforts to reach US government networks.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“This threat actor was using this server and this company’s network to scan the US Department of Defense’s servers”
APT10 TARGETS United States Department of Energy
The US attorney said APT10 hacking campaigns targeted the US Department of Energy.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“the laboratories of NASA, the United States Department of Energy, and the US Navy”
Cloud Hopper TARGETS Managed Service Provider
The campaign targeted MSPs because they had trusted access to customer networks and data.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
The US attorney said APT10 hacking campaigns targeted NASA laboratories.
Attributed Confidence 99% · Jeffrey Burman EP 103 Details
“targeted US government agencies including the laboratories of NASA”