Home / Threat actors / menuPass

menuPass G0045

🔔 Create alert

Also known as: Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

54

Techniques

25

Malware and tools

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).”

Techniques by tactic

Resource Development

T1583.001 Domains T1588.002 Tool

Initial Access

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1204.002 Malicious File T1574.001 DLL

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts

Privilege Escalation

T1053.005 Scheduled Task T1055.012 Process Hollowing T1078 Valid Accounts

Stealth

T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.005 Match Legitimate Resource Name or Location T1055.012 Process Hollowing T1070.003 Clear Command History T1070.004 File Deletion T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1218.004 InstallUtil T1574.001 DLL

Defense Impairment

T1553.002 Code Signing

Credential Access

T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1056.001 Keylogging

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1083 File and Directory Discovery T1087.002 Domain Account

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.004 SSH T1210 Exploitation of Remote Services

Collection

T1005 Data from Local System T1039 Data from Network Shared Drive T1056.001 Keylogging T1074.001 Local Data Staging T1074.002 Remote Data Staging T1119 Automated Collection T1560 Archive Collected Data T1560.001 Archive via Utility

Command and Control

T1090.002 External Proxy T1105 Ingress Tool Transfer T1568.001 Fast Flux DNS

Malware and tools

ChChesMalwareS0144
Cobalt StrikeMalwareS0154
EcipekacMalwareS0624
EvilGrabMalwareS0152
FYAntiMalwareS0628
HUI LoaderMalwareS1097
P8RATMalwareS0626
PlugXMalwareS0013
PoisonIvyMalwareS0012
RedLeavesMalwareS0153
SNUGRIDEMalwareS0159
SodaMasterMalwareS0627
UPPERCUTMalwareS0275
AdFindToolS0552
certutilToolS0160
cmdToolS0106
esentutlToolS0404
ImpacketToolS0357
MimikatzToolS0002
NetToolS0039
PingToolS0097
PowerSploitToolS0194
PsExecToolS0029
pwdumpToolS0006
QuasarRATToolS0262

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.