menuPass

Introduction

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security’s (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. DOJ APT10 Dec 2018 District Court of NY APT10 Indictment December 2018 menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university. Palo Alto menuPass Feb 2017 Crowdstrike CrowdCast Oct 2013 FireEye Poison Ivy PWC Cloud Hopper April 2017 FireEye APT10 April 2017 DOJ APT10 Dec 2018 District Court of NY APT10 Indictment December 2018

Activities and Tactics

Targeted Sectors: Private sector, Government

Country of Origin: 🇨🇳 China

Incident Type: Espionage

Suspected Victims: Japan, India, South Africa, South Korea, Sweden, United States, Canada, Australia, France, Finland…

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1018 Remote System Discovery
• T1047 Windows Management Instrumentation
• T1036 Masquerading
• T1070.004 File Deletion
• T1046 Network Service Discovery
• T1049 System Network Connections Discovery
• T1560.001 Archive via Utility
• T1566.001 Spearphishing Attachment
• T1105 Ingress Tool Transfer
• T1588.002 Tool
• T1204.002 Malicious File
• T1090.002 External Proxy
• T1078 Valid Accounts
• T1016 System Network Configuration Discovery
• T1568.001 Fast Flux DNS
• T1036.003 Rename Legitimate Utilities
• T1056.001 Keylogging
• T1087.002 Domain Account
• T1003.003 NTDS
• T1218.004 InstallUtil
• T1106 Native API
• T1003.002 Security Account Manager
• T1027.013 Encrypted/Encoded File
• T1199 Trusted Relationship
• T1190 Exploit Public-Facing Application
• T1074.002 Remote Data Staging
• T1070.003 Clear Command History
• T1140 Deobfuscate/Decode Files or Information
• T1553.002 Code Signing
• T1053.005 Scheduled Task
• T1055.012 Process Hollowing
• T1074.001 Local Data Staging
• T1021.001 Remote Desktop Protocol
• T1039 Data from Network Shared Drive
• T1003.004 LSA Secrets
• T1083 File and Directory Discovery
• T1036.005 Match Legitimate Resource Name or Location
• T1560 Archive Collected Data
• T1059.003 Windows Command Shell
• T1005 Data from Local System
• T1059.001 PowerShell
• T1210 Exploitation of Remote Services
• T1021.004 SSH
• T1119 Automated Collection
• T1583.001 Domains
• T1574.001 DLL

ATT&CK technique IDs (denormalized)

• T1003.002
• T1003.003
• T1003.004
• T1005
• T1016
• T1018
• T1021.001
• T1021.004
• T1027.013
• T1036
• T1036.003
• T1036.005
• T1039
• T1046
• T1047
• T1049
• T1053.005
• T1055.012
• T1056.001
• T1059.001
• T1059.003
• T1070.003
• T1070.004
• T1074.001
• T1074.002
• T1078
• T1083
• T1087.002
• T1090.002
• T1105
• T1106
• T1119
• T1140
• T1190
• T1199
• T1204.002
• T1210
• T1218.004
• T1553.002
• T1560
• T1560.001
• T1566.001
• T1568.001
• T1574.001
• T1583.001
• T1588.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• SPACESHIP:
• CloudDuke:
• PoisonIvy:
• CyberGate:
• Cyber Eye RAT:

MITRE ATT&CK Software

• certutil (S0160) — tool
• FYAnti (S0628) — malware
• UPPERCUT (S0275) — malware
• SNUGRIDE (S0159) — malware
• P8RAT (S0626) — malware
• RedLeaves (S0153) — malware
• SodaMaster (S0627) — malware
• pwdump (S0006) — tool
• Mimikatz (S0002) — tool
• PlugX (S0013) — malware
• Net (S0039) — tool
• PowerSploit (S0194) — tool
• ChChes (S0144) — malware
• cmd (S0106) — tool
• QuasarRAT (S0262) — tool
• AdFind (S0552) — tool
• Cobalt Strike (S0154) — malware
• PoisonIvy (S0012) — malware
• EvilGrab (S0152) — malware
• esentutl (S0404) — tool
• Impacket (S0357) — tool
• Ecipekac (S0624) — malware
• Ping (S0097) — tool
• PsExec (S0029) — tool
• HUI Loader (S1097) — malware

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [11] Accenture Hogfish April 2018 Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018. [12] SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023. [13] Crowdstrike CrowdCast Oct 2013 Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem. Retrieved November 17, 2024. [14] FireEye APT10 April 2017 FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017. [15] FireEye Poison Ivy FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024. [16] FireEye APT10 Sept 2018 Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018. [17] Palo Alto menuPass Feb 2017 Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017. [18] PWC Cloud Hopper April 2017 PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017. [19] Symantec Cicada November 2020 Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020. [20] DOJ APT10 Dec 2018 United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019. [21] District Court of NY APT10 Indictment December 2018 US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.