APT10 — Threat Actors — SecurityStudies.info

Profile

Also known as: ATK41, BRONZE RIVERSIDE, Cicada, Cloud Hopper, CVNX, G0045, Granite Taurus, happyyongzi, HOGFISH, menuPass, Menupass Team, POTASSIUM, Purple Typhoon, Red Apollo, STONE PANDA, TA429

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.

Related profiles: MirrorFace, Witchetty

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 46

Resource Development

T1583.001Domains T1588.002Tool

Initial Access

T1078Valid Accounts T1190Exploit Public-Facing Application T1199Trusted Relationship T1566.001Spearphishing Attachment

Execution

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.003Windows Command Shell T1106Native API T1204.002Malicious File T1574.001DLL

Privilege Escalation

T1055.012Process Hollowing

Stealth

T1027.013Encrypted/Encoded File T1036Masquerading T1036.003Rename Legitimate Utilities T1036.005Match Legitimate Resource Name or Location T1070.003Clear Command History T1070.004File Deletion T1140Deobfuscate/Decode Files or Information T1218.004InstallUtil

Defense Impairment

T1553.002Code Signing

Credential Access

T1003.002Security Account Manager T1003.003NTDS T1003.004LSA Secrets T1056.001Keylogging

Discovery

T1016System Network Configuration Discovery T1018Remote System Discovery T1046Network Service Discovery T1049System Network Connections Discovery T1083File and Directory Discovery T1087.002Domain Account

Lateral Movement

T1021.001Remote Desktop Protocol T1021.004SSH T1210Exploitation of Remote Services

Collection

T1005Data from Local System T1039Data from Network Shared Drive T1074.001Local Data Staging T1074.002Remote Data Staging T1119Automated Collection T1560Archive Collected Data T1560.001Archive via Utility

Command and Control

T1090.002External Proxy T1105Ingress Tool Transfer T1568.001Fast Flux DNS

Incidents attributed

No incident in the register is attributed to this actor.

In the news

No Asia-Pacific article names this actor yet.

csrftoken	CSRF protection — prevents cross-site request forgery attacks	1 year	Essential
sessionid	Session management — keeps authenticated users logged in	14 days	Essential