MITRE ATT&CKgroup
G0045 menuPass
- Domain
- enterprise
- Aliases
- Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE
- Version
- 3.0
- Created
- 2017-05-31
Description
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.
Related
Uses · MITRE ATT&CK (71)
- T1027.013 Encrypted/Encoded File sub-technique
- S1097 HUI Loader software (malware)
- S0628 FYAnti software (malware)
- S0626 P8RAT software (malware)
- S0627 SodaMaster software (malware)
- S0624 Ecipekac software (malware)
- S0552 AdFind software (tool)
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1090.002 External Proxy sub-technique
- T1074.001 Local Data Staging sub-technique
- T1074.002 Remote Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1568.001 Fast Flux DNS sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1003.004 LSA Secrets sub-technique
- T1087.002 Domain Account sub-technique
- T1560 Archive Collected Data technique
- T1560.001 Archive via Utility sub-technique
- T1003.002 Security Account Manager sub-technique
- T1003.003 NTDS sub-technique
- T1021.001 Remote Desktop Protocol sub-technique
- T1021.004 SSH sub-technique
- T1056.001 Keylogging sub-technique
- T1036.003 Rename Legitimate Utilities sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1553.002 Code Signing sub-technique
References
- http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf Accenture Hogfish April 2018
- https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
- https://www.slideshare.net/slideshow/crowd-casts-monthly-you-have-an-adversary-problem/27262315 Crowdstrike CrowdCast Oct 2013
- https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html FireEye APT10 April 2017
- https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf FireEye Poison Ivy
- https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html FireEye APT10 Sept 2018
- http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/ Palo Alto menuPass Feb 2017
- https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf PWC Cloud Hopper April 2017
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage Symantec Cicada November 2020
- https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion DOJ APT10 Dec 2018
- https://www.justice.gov/opa/page/file/1122671/download District Court of NY APT10 Indictment December 2018