FORENSIA

THREAT_ACTOR · G0045

menuPass

Also known as: menuPass, Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo, CVNX, HOGFISH, BRONZE RIVERSIDE

Profile

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

MITRE ATT&CK ↗

Techniques

46 ATT&CK techniques attributed to this actor.

T1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1005 Data from Local SystemT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.004 SSHT1027.013 Encrypted/Encoded FileT1036 MasqueradingT1036.003 Rename Legitimate UtilitiesT1036.005 Match Legitimate Resource Name or LocationT1039 Data from Network Shared DriveT1046 Network Service DiscoveryT1047 Windows Management InstrumentationT1049 System Network Connections DiscoveryT1053.005 Scheduled TaskT1055.012 Process HollowingT1056.001 KeyloggingT1059.001 PowerShellT1059.003 Windows Command ShellT1070.003 Clear Command HistoryT1070.004 File DeletionT1074.001 Local Data StagingT1074.002 Remote Data StagingT1078 Valid AccountsT1083 File and Directory DiscoveryT1087.002 Domain AccountT1090.002 External ProxyT1105 Ingress Tool TransferT1106 Native APIT1119 Automated CollectionT1140 Deobfuscate/Decode Files or InformationT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1204.002 Malicious FileT1210 Exploitation of Remote ServicesT1218.004 InstallUtilT1553.002 Code SigningT1560 Archive Collected DataT1560.001 Archive via UtilityT1566.001 Spearphishing AttachmentT1568.001 Fast Flux DNST1574.001 DLLT1583.001 DomainsT1588.002 Tool

Software

25 malware/tools attributed to this actor.

MimikatzpwdumpPoisonIvyPlugXPsExecNetPingcmdChChesEvilGrabRedLeavesCobalt StrikeSNUGRIDEcertutilPowerSploitQuasarRATUPPERCUTImpacketesentutlAdFindEcipekacP8RATSodaMasterFYAntiHUI Loader

Related corpus activity

9,992 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to menuPass.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-11837cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2016-5681cve—852
cve-2025-66478cve—852
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2025-68670cve—852
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2022-47945cve—851
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2025-23304cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 9,992.