Início / Grupos de ameaça / menuPass

menuPass G0045

🔔 Criar alerta

Também conhecido como: Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

54

Técnicas

25

Malwares e ferramentas

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2020-1472 Média · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).”

Técnicas por tática

Desenvolvimento de recursos

T1583.001 Domains T1588.002 Tool

Acesso inicial

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1566.001 Spearphishing Attachment

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1106 Native API T1204.002 Malicious File T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts

Escalada de privilégios

T1053.005 Scheduled Task T1055.012 Process Hollowing T1078 Valid Accounts

Furtividade

T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.005 Match Legitimate Resource Name or Location T1055.012 Process Hollowing T1070.003 Clear Command History T1070.004 File Deletion T1078 Valid Accounts T1140 Deobfuscate/Decode Files or Information T1218.004 InstallUtil T1574.001 DLL

Comprometimento de defesas

T1553.002 Code Signing

Acesso a credenciais

T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1056.001 Keylogging

Descoberta

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1083 File and Directory Discovery T1087.002 Domain Account

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH T1210 Exploitation of Remote Services

Coleta

T1005 Data from Local System T1039 Data from Network Shared Drive T1056.001 Keylogging T1074.001 Local Data Staging T1074.002 Remote Data Staging T1119 Automated Collection T1560 Archive Collected Data T1560.001 Archive via Utility

Comando e controle

T1090.002 External Proxy T1105 Ingress Tool Transfer T1568.001 Fast Flux DNS

Malwares e ferramentas

ChChesMalwareS0144
Cobalt StrikeMalwareS0154
EcipekacMalwareS0624
EvilGrabMalwareS0152
FYAntiMalwareS0628
HUI LoaderMalwareS1097
P8RATMalwareS0626
PlugXMalwareS0013
PoisonIvyMalwareS0012
RedLeavesMalwareS0153
SNUGRIDEMalwareS0159
SodaMasterMalwareS0627
UPPERCUTMalwareS0275
AdFindFerramentaS0552
certutilFerramentaS0160
cmdFerramentaS0106
esentutlFerramentaS0404
ImpacketFerramentaS0357
MimikatzFerramentaS0002
NetFerramentaS0039
PingFerramentaS0097
PowerSploitFerramentaS0194
PsExecFerramentaS0029
pwdumpFerramentaS0006
QuasarRATFerramentaS0262

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.