menuPassThreat actor
- APT10
- atk41
- bronze riverside
- Cicada
- cloud hopper
- cvnx
- g0045
- granite taurus
- happyyongzi
- hogfish
- menupass team
- potassium
- purple typhoon
- red apollo
- stone panda
- ta429
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.From MITRE ATT&CK
Last reported 4 months ago, by Sekoia.io4 reports
ATT&CK techniques
6 of 29 · each with the sentence it comes from- T1014Rootkit
“…e the leak of ValleyRAT builder in 2023, the intrusion set continued to use it, exploiting zero-day driver plugin and using kernel-mode rootkit likely for intelligence collection.”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1021.001Remote Desktop Protocol
“| ResolveDoRestoreNLA | Restores the security settings for Remote Desktop Protocol (RDP), enabling Network Level Authentication (NLA) and enforcing SSL/TLS encryption for secure communication.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“These organized campaigns target victims by masquerading as legitimate software such as web browsers or social media messaging services.”
- T1046Network Service Discovery
“T1046 Network Service Scanning”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Silver Fox: The only Tax Audit Where Fine Print Installs Malware“… Taiwan faces a surge in Chinese offensive cyber operations, notably marked by state-sponsored operations attributed to Salt Typhoon and APT10, likely directed to intelligence collection and critical infrastructure prepositioning.”
-
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite“…non-state hacktivism, and criminal financially motivated attacks since 2017 (Qualys, Evolution of Quasar RAT), including by China-linked APT10.”
-
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group“Researcher’s Note: The ‘original’ Cicada 3301 emerged in 2012 as an enigmatic cryptographic puzzle group, challenging individuals worldwide with complex ciphers, hidden clues in both digital and physical spaces, and references to esoteric literature, philosophy, and art, creating…”
-
Top 3 Cybersecurity Threats of 2024 (So Far)“…e becoming more prevalent this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.”
Indicators in its reports
named in the reports above- e2b75baeb7ed21fb…167bd24ba6dcin 1 report
- hxxps://6-1321729461.cos.ap-guangzhou.myqcloud[.]com/lnstaller.msiin 1 report
- hxxps://00-1321729461.cos.ap-guangzhou.myqcloud[.]com/2024.7zin 1 report
- 9010.360sdgg[.]comin 1 report
- googlevip[.]icuin 1 report
- oytdwzz[.]shopin 1 report
- andyvxyngw[.]cnin 1 report
- f9eaab0f05bd38a2…86ca7ceddce8in 1 report
- 154.201.87[.]75in 1 report
- 154.201.87[.]124in 1 report
- hxxps://xqwmwru[.]top/upload_large.phpin 1 report
- xqwmwru[.]topin 1 report
- hxxps://xqwmwru[.]top/upload_status.phpin 1 report
- 115.187.17[.]212in 1 report
- 112.121.183[.]102in 1 report
- 156.251.18[.]45in 1 report
- 206.238.178[.]116in 1 report
- 112.213.120[.]164in 1 report
- 47.85.99[.]19in 1 report
- 216.250.104[.]166in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.