TA410

TA410 is a China-nexus cyberespionage threat actor, described as an umbrella group loosely linked to APT10 but tracked as a distinct entity. Known aliases mentioned in the content include Witchetty. Reporting cited in the content associates TA410 with sustained espionage activity targeting the U.S. utilities sector, Middle Eastern governments, and Japanese organizations. Proofpoint attributed both the LookBack and FlowCloud malware campaigns observed between July and November 2019 to TA410 based on shared attachment macros, malware installation techniques, and overlapping delivery infrastructure. In those campaigns, TA410 targeted U.S. utility providers with phishing lures themed around energy training and certification, impersonating organizations such as ASCE, NCEES, and Global Energy Certification. In some cases, both malware families targeted the same companies and recipients. TA410 shifted FlowCloud delivery from PE attachments to malicious Word documents with macros that mirrored LookBack tradecraft, including handling .pem files, renaming payloads, use of certutil-related execution, and overlapping staging infrastructure. FlowCloud, attributed in the content to TA410 activity, is a modular C++ remote access trojan providing broad system access, including files, processes, services, screen, keyboard, mouse, clipboard, and data exfiltration. The malware used legitimate and imitation QQ components during execution, stored configuration and keylogger data in registry keys, and communicated with command-and-control infrastructure using a custom encrypted binary protocol. Proofpoint assessed FlowCloud may have been active since at least 2016. The content also states that ESET reported an XLL stage in TA410 activity in 2020. Cisco Talos describes TA410 as a cyberespionage umbrella group loosely linked to APT10 and cites a TA410-related process injection DLL, onkeytoken_keb.dll, that exports xlAutoOpen but triggers injection via the exported function OnKeyT_ContextInit. Additional reporting in the content notes TA410 notably targeted Japanese organizations with FlowCloud. While the content notes overlaps between TA410 and APT10/TA429 tactics or infrastructure, it explicitly states TA410 is tracked as a distinct entity and that some overlaps may reflect shared tooling, infrastructure, or possible false-flag reuse rather than direct attribution to APT10.