State-backedChina MITRE G0045

APT10

Also known as STONE PANDA, Menupass Team, happyyongzi, POTASSIUM, Red Apollo, CVNX, HOGFISH, Cloud Hopper, BRONZE RIVERSIDE, ATK41, G0045, Granite Taurus, TA429, Cicada, Purple Typhoon, menuPass

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.

Targets: Private sector, Government, Japan, India, South Africa, South Korea, Sweden, United States, Canada, Australia, France, Finland, United Kingdom, Brazil, Thailand

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.002 Security Account Manager T1003.003 NTDS T1003.004 LSA Secrets T1005 Data from Local System T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.004 SSH T1027.013 Encrypted/Encoded File T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.005 Match Legitimate Resource Name or Location T1039 Data from Network Shared Drive T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1055.012 Process Hollowing T1056.001 Keylogging T1059.001 PowerShell T1059.003 Windows Command Shell T1070.003 Clear Command History T1070.004 File Deletion T1074.001 Local Data Staging T1074.002 Remote Data Staging T1078 Valid Accounts T1083 File and Directory Discovery T1087.002 Domain Account T1090.002 External Proxy T1105 Ingress Tool Transfer T1106 Native API T1119 Automated Collection T1140 Deobfuscate/Decode Files or Information T1190 Exploit Public-Facing Application T1199 Trusted Relationship T1204.002 Malicious File T1210 Exploitation of Remote Services T1218.004 InstallUtil T1553.002 Code Signing T1560 Archive Collected Data T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1568.001 Fast Flux DNS T1574.001 DLL T1583.001 Domains T1588.002 Tool

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.