- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Sponsor
- China
- Agency named
- MSS, Ministry of State Security, Tianjin State Security Bureau
- Motivation
- Espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0045 · 46 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0135 · menupass
ChinaWhat it is
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Stone Panda
- Mandiant
- APT10
- Microsoft
- Purple Typhoon
- MITRE ATT&CK
- G0045
- Proofpoint
- TA429
- PwC
- Red Apollo
- Secureworks
- BRONZE RIVERSIDE
- Thales
- ATK41
- Other names
- AEON, ChChes, Cicada, Cloud Hopper, CVNX, Evilgrab, Foxmail, Foxtrot, GOLEM, Granite Taurus, happyyongzi, Haymaker, HOGFISH, LIVESAFE, Menupass Team, POTASSIUM, Webmonder
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)China
- MicrosoftChina
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Australia, Brazil, Canada, Finland, France, India, Japan, Norway, South Africa, South Korea, Sweden, Switzerland, Thailand, United Kingdom, United States
- Sectors
- Government, Private sector
Tools
The tools and malware families the sources tie to it.
- AdFind
- ChChes
- China Chopper
- CloudDuke
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Ecipekac
- EvilGrab
- FYAnti
- HUI Loader
- Impacket
- Mimikatz
- Net
- P8RAT
- Ping
- PlugX
- PoisonIvy
- PowerSploit
- PsExec
- QuasarRAT
- RedLeaves
- SNUGRIDE
- SPACESHIP
- SodaMaster
- UPPERCUT
- certutil
- cmd
- esentutl
- pwdump
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de