menuPass
Also tracked as Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.
- Documented techniques
- 46
- First seen
- 2006
- Basis
- MITRE ATT&CK
How they break in
Techniques MITRE has documented this group using, grouped by the stage of an attack they belong to. This is the actionable half: each one is a behaviour you can look for in your own logs, and a control you can test.
resource development2
initial access3
execution6
credential access3
discovery6
lateral movement3
collection8
command and control3
defense impairment1
stealth11
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1036.003 Rename Legitimate Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1055.012 Process Hollowing
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1078 Valid Accounts
- T1140 Deobfuscate/Decode Files or Information
- T1218.004 InstallUtil
- T1574.001 DLL
Malware
Families MITRE records this group deploying. Detection names for these are a reasonable place to start.
Tools
Legitimate or dual-use software the group is documented using. Most of it is software your own administrators use too, which is the point.