menuPass
- ID
- G0045
- Associated names
- Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]
Techniques used (46)
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1036.003 Rename Legitimate Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1119 Automated Collection
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1218.004 InstallUtil
- T1553.002 Code Signing
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1568.001 Fast Flux DNS
- T1574.001 DLL
- T1583.001 Domains
- T1588.002 Tool
Software used (25)
- S0002 Mimikatz
- S0006 pwdump
- S0012 PoisonIvy
- S0013 PlugX
- S0029 PsExec
- S0039 Net
- S0097 Ping
- S0106 cmd
- S0144 ChChes
- S0152 EvilGrab
- S0153 RedLeaves
- S0154 Cobalt Strike
- S0159 SNUGRIDE
- S0160 certutil
- S0194 PowerSploit
- S0262 QuasarRAT
- S0275 UPPERCUT
- S0357 Impacket
- S0404 esentutl
- S0552 AdFind
- S0624 Ecipekac
- S0626 P8RAT
- S0627 SodaMaster
- S0628 FYAnti
- S1097 HUI Loader
