Operation Cloud Hopper, conducted in 2018, targeted IT service providers to steal sensitive data. Which group carried out this operation?

Operation Cloud Hopper, conducted in 2018, targeted IT service providers to steal sensitive data. Which group carried out this operation?

• A. Russian GRU
• B. Iranian MSS
• C. US Cyber Command
• D. Chinese MSS

Answer: (D)

Operation Cloud Hopper is a lesson in how state-sponsored groups conduct long-term espionage by abusing trusted partners. The campaign, active around 2016–2018, targeted IT service providers so attackers could slip into the networks of many clients through a single foothold. That supply-chain approach lets a single intrusion yield access to a wide array of sensitive data across multiple industries, making the operation highly attractive for intelligence gathering. Credible threat-intelligence analyses linked this activity to APT10, a group widely described as a state-sponsored actor tied to China's Ministry of State Security. Analysts observed consistent patterns—the specific tooling, infrastructure, and long-horizon intrusions—that align with what researchers attribute to APT10 and to the broader set of Chinese MSS-linked campaigns. This combination of technique, target choice, and attribution is why the operation is associated with the Chinese MSS. The other groups listed have different, well-documented campaigns and rationale, so they don’t fit the same attribution as Cloud Hopper.

Operation Cloud Hopper is a lesson in how state-sponsored groups conduct long-term espionage by abusing trusted partners. The campaign, active around 2016–2018, targeted IT service providers so attackers could slip into the networks of many clients through a single foothold. That supply-chain approach lets a single intrusion yield access to a wide array of sensitive data across multiple industries, making the operation highly attractive for intelligence gathering.

Credible threat-intelligence analyses linked this activity to APT10, a group widely described as a state-sponsored actor tied to China's Ministry of State Security. Analysts observed consistent patterns—the specific tooling, infrastructure, and long-horizon intrusions—that align with what researchers attribute to APT10 and to the broader set of Chinese MSS-linked campaigns. This combination of technique, target choice, and attribution is why the operation is associated with the Chinese MSS.

The other groups listed have different, well-documented campaigns and rationale, so they don’t fit the same attribution as Cloud Hopper.