menuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.
- ATT&CK ID
- G0045
- Origin
- China
- Techniques
- 37
- Tools
- 25
Also tracked as Cicada · POTASSIUM · Stone Panda · APT10 · Red Apollo · CVNX · HOGFISH · BRONZE RIVERSIDE
Vulnerabilities it has exploited
Techniques
Resource Development
Acquire InfrastructureObtain Capabilities
Initial Access
Valid AccountsExploit Public-Facing ApplicationTrusted RelationshipPhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterNative APIUser ExecutionHijack Execution Flow
Persistence
Scheduled Task/JobValid Accounts
Privilege Escalation
Scheduled Task/JobProcess InjectionValid Accounts
Stealth
Obfuscated Files or InformationMasqueradingProcess InjectionIndicator RemovalValid AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionHijack Execution Flow
Defense Impairment
Credential Access
OS Credential DumpingInput Capture
Discovery
System Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoverySystem Network Connections DiscoveryFile and Directory DiscoveryAccount Discovery
Lateral Movement
Remote ServicesExploitation of Remote Services
Collection
Data from Local SystemData from Network Shared DriveInput CaptureData StagedAutomated CollectionArchive Collected Data
Command and Control
ProxyIngress Tool TransferDynamic Resolution
Software
AdFind · ChChes · Cobalt Strike · Ecipekac · EvilGrab · FYAnti · HUI Loader · Impacket · Mimikatz · Net · P8RAT · Ping · PlugX · PoisonIvy · PowerSploit · PsExec · QuasarRAT · RedLeaves · SNUGRIDE · SodaMaster · UPPERCUT · certutil · cmd · esentutl · pwdump