APT10’s primary motivation is cyber espionage, targeting intellectual property, trade secrets, and sensitive government data. Their strategies focus on stealth and persistence, ensuring prolonged access to victim environments for large-scale data theft.

APT10 uses spear-phishing emails with malicious attachments as a common entry point into networks. They compromise Managed Service Providers (MSPs) to indirectly access client networks—an approach heavily employed during the “Cloud Hopper” campaign. The group also exploits vulnerabilities in Virtual Private Networks (VPNs) and remote access tools to gain initial or secondary access.

Their custom malware arsenal includes tools such as RedLeaves RAT, Quasar RAT, and PlugX, in addition to credential harvesting tools like Mimikatz. Persistence is maintained through methods such as creating admin accounts, scheduled tasks, and DLL side-loading. They exfiltrate data using encrypted communication channels.