menuPass

Also known as:Cicada · POTASSIUM · Stone Panda · APT10 · Red Apollo · CVNX · HOGFISH · BRONZE RIVERSIDE

Overview

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

Naming & attribution

menuPass is tracked under 9 names across the industry. It uses 46 documented ATT&CK techniques — more than 81% of the 174 groups tracked here. Activity attributed since at least 2006.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Cicada	Symantec
POTASSIUM	United States District Court Southern District of New York (USDC SDNY)
Stone Panda	Miller-Osborn, J. and Grunzweig, J.
APT10	Miller-Osborn, J. and Grunzweig, J.
Red Apollo	PwC and BAE Systems
CVNX	PwC and BAE Systems
HOGFISH	Accenture Security
BRONZE RIVERSIDE	Counter Threat Unit Research Team

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1218.004 InstallUtil — used by 2 of 174 groups
T1568.001 Fast Flux DNS — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Threat Group-3390 China — 28 shared techniques (37% overlap)
GALLIUM China — 19 shared techniques (33% overlap)
FIN13 — 24 shared techniques (32% overlap)
Chimera China — 24 shared techniques (30% overlap)
Dragonfly Russia — 23 shared techniques (29% overlap)
APT39 Iran — 22 shared techniques (29% overlap)

Targets

Government · Private sector

Regions

Australia · Brazil · Canada · Finland · France · India · Japan · Norway · South Africa · South Korea · Sweden · Switzerland · Thailand · United Kingdom · United States

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190
Custom malware/implant development — ATT&CK: 13 attributed custom malware families

TTPs — 46 techniques across 10 tactics

Resource Development

T1583.001Domains
T1588.002Tool

Lateral Movement

Collection

Command and Control

Tools & malware (25)

certutil · FYAnti · UPPERCUT · SNUGRIDE · P8RAT · RedLeaves · SodaMaster · pwdump · Mimikatz · PlugX · Net · PowerSploit · ChChes · cmd · QuasarRAT · AdFind · Cobalt Strike · PoisonIvy · EvilGrab · esentutl · Impacket · Ecipekac · Ping · PsExec · HUI Loader

Reporting (3)

BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER — Counter Threat Unit Research Team
Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign — Symantec
United States of America v. Zhu Hua and Zhang Shilong — United States District Court Southern District of New York (USDC SDNY)