APT10
ChinaState-sponsoredUnknown
Observation period
46
Techniques
0
Reports
- Latest observed activity
- No dated reports available
- First observed
- —
Profile
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.
Relevance for Germany, Austria and Switzerland
high
Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).
Target sectors according to source
- Private sector
- Government
Target countries according to source Japan, India, South Africa, South Korea, Sweden, United States, Canada, Australia, France, Finland, United Kingdom, Brazil, Thailand, Switzerland, Norway
Aliases
- STONE PANDA
- Menupass Team
- happyyongzi
- POTASSIUM
- Red Apollo
- CVNX
- HOGFISH
- Cloud Hopper
- BRONZE RIVERSIDE
- ATK41
- Granite Taurus
- TA429
- Cicada
- Purple Typhoon
MITRE ATT&CK techniques
Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.
- T1018
- T1047
- T1036
- T1070.004
- T1046
- T1049
- T1560.001
- T1566.001
- T1105
- T1588.002
- T1204.002
- T1090.002
- T1078
- T1016
- T1568.001
- T1036.003
- T1056.001
- T1087.002
- T1003.003
- T1218.004
- T1106
- T1003.002
- T1027.013
- T1199
- T1190
- T1074.002
- T1070.003
- T1140
- T1553.002
- T1053.005
- T1055.012
- T1074.001
- T1021.001
- T1039
- T1003.004
- T1083
- T1036.005
- T1560
- T1059.003
- T1005
- T1059.001
- T1210
- T1021.004
- T1119
- T1583.001
- T1574.001
Software / tooling used
External references
- unit42.paloaltonetworks.comunit42.paloaltonetworks.com
- cfr.orgcfr.org
- ncsc.gov.ukncsc.gov.uk
- pwc.co.ukpwc.co.uk
- fireeye.comfireeye.com
- eweek.comeweek.com
- blog.trendmicro.comblog.trendmicro.com
- accenture.comaccenture.com
- us-cert.govus-cert.gov
- fireeye.comfireeye.com
- fbi.govfbi.gov
- attack.mitre.orgattack.mitre.org
- secureworks.comsecureworks.com
- unit42.paloaltonetworks.comunit42.paloaltonetworks.com
- mandiant.commandiant.com
- pwc.co.ukpwc.co.uk
- fireeye.comfireeye.com
- proofpoint.comproofpoint.com
- crowdstrike.comcrowdstrike.com
- symantec-enterprise-blogs.security.comsymantec-enterprise-blogs.security.com