menuPass

Origin🇨🇳 China

Techniques (MITRE ATT&CK)46

SourceMITRE ATT&CK

State sponsor: ChinaAttribution confidence: 50%Target categories: Private sector, Government

Targeted regions: Japan · India · South Africa · South Korea · Sweden · United States · Canada · Australia · France · Finland +5

Also known as:APT10ATK41BRONZE RIVERSIDECVNXCicadaCloud HopperG0045Granite TaurusHOGFISHMenupass TeamPOTASSIUMPurple TyphoonRed ApolloSTONE PANDAStone PandaTA429happyyongzi

About the group

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity64

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 46

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Tool

Initial access

Exploit Public-Facing Application Trusted Relationship Spearphishing Attachment

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Native API Malicious File

Credential access

Security Account Manager NTDS LSA Secrets

Discovery

System Network Configuration Discovery Remote System Discovery Network Service Discovery System Network Connections Discovery File and Directory Discovery Domain Account

Lateral movement

Remote Desktop Protocol SSH Exploitation of Remote Services

Collection

Data from Local System Data from Network Shared Drive Keylogging Local Data Staging Remote Data Staging Automated Collection Archive Collected Data Archive via Utility

Command and control

External Proxy Ingress Tool Transfer Fast Flux DNS

defense-impairment

Code Signing

stealth

Encrypted/Encoded File Masquerading Rename Legitimate Utilities Match Legitimate Resource Name or Location Process Hollowing Clear Command History File Deletion Valid Accounts Deobfuscate/Decode Files or Information InstallUtil DLL

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2020-1472MEDIUMEPSS 99%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

References

menuPass uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →