LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

EnterpriseG0045GroupObject v3.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0045: menuPass describes [menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://attack.mitre.org/groups/G0045) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) [menuPass](https://attack.mitre.org/groups/G00...

Executive priority

G0045: menuPass is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0045: menuPass by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0045: menuPass appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

46 rows
DomainIDNameRelationship / procedure
EnterpriseT1018Remote System Discovery

menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.CitationPWC Cloud Hopper Technical Annex April 2017[7]

EnterpriseT1047Windows Management Instrumentation

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.CitationPWC Cloud Hopper Technical Annex April 2017CitationGithub AD-Pentest-Script[8]

EnterpriseT1036Masquerading

menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.[9]

EnterpriseT1070.004File DeletionSub-technique

A menuPass macro deletes files after it has decoded and decompressed them.[10][2]

EnterpriseT1046Network Service Discovery

menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1049System Network Connections Discovery

menuPass has used net use to conduct connectivity checks to machines.[6]

EnterpriseT1560.001Archive via UtilitySub-technique

menuPass has compressed files before exfiltration using TAR and RAR.[6]CitationPWC Cloud Hopper Technical Annex April 2017[8]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.CitationPWC Cloud Hopper Technical Annex April 2017[7][9][2]

EnterpriseT1105Ingress Tool Transfer

menuPass has installed updates and new malware on victims.[6][2]

EnterpriseT1588.002ToolSub-technique

menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1204.002Malicious FileSub-technique

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.CitationPWC Cloud Hopper Technical Annex April 2017[7][10][9][2]

EnterpriseT1090.002External ProxySub-technique

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.[7][9]

EnterpriseT1078Valid Accounts

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.[6][8][2]CitationSecurelist APT10 March 2021

EnterpriseT1016System Network Configuration Discovery

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1568.001Fast Flux DNSSub-technique

menuPass has used dynamic DNS service providers to host malicious domains.[2]

EnterpriseT1036.003Rename Legitimate UtilitiesSub-technique

menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.[9]

EnterpriseT1056.001KeyloggingSub-technique

menuPass has used key loggers to steal usernames and passwords.[2]

EnterpriseT1087.002Domain AccountSub-technique

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1003.003NTDSSub-technique

menuPass has used Ntdsutil to dump credentials.[8]

EnterpriseT1218.004InstallUtilSub-technique

menuPass has used InstallUtil.exe to execute malicious software.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1106Native API

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.[8]

EnterpriseT1003.002Security Account ManagerSub-technique

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.CitationPWC Cloud Hopper Technical Annex April 2017CitationGithub AD-Pentest-Script

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.[10][9][8]

EnterpriseT1199Trusted Relationship

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.CitationPWC Cloud Hopper Technical Annex April 2017[7][8][1][2]

EnterpriseT1190Exploit Public-Facing Application

menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.CitationSecurelist APT10 March 2021

EnterpriseT1074.002Remote Data StagingSub-technique

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.[6][8]

EnterpriseT1070.003Clear Command HistorySub-technique

menuPass has used Wevtutil to remove PowerShell execution logs.CitationSecurelist APT10 March 2021

EnterpriseT1140Deobfuscate/Decode Files or Information

menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.[10][9]

EnterpriseT1553.002Code SigningSub-technique

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.CitationSecurelist APT10 March 2021

EnterpriseT1053.005Scheduled TaskSub-technique

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.CitationPWC Cloud Hopper Technical Annex April 2017

EnterpriseT1055.012Process HollowingSub-technique

menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.[10]

EnterpriseT1074.001Local Data StagingSub-technique

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.[6]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

menuPass has used RDP connections to move across the victim network.[6][2]

EnterpriseT1039Data from Network Shared Drive

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.[6]

EnterpriseT1003.004LSA SecretsSub-technique

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.CitationPWC Cloud Hopper Technical Annex April 2017CitationGithub AD-Pentest-Script

EnterpriseT1083File and Directory Discovery

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.[8]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

menuPass has been seen changing malicious files to appear legitimate.[2]

EnterpriseT1560Archive Collected Data

menuPass has encrypted files and information before exfiltration.[1][2]

EnterpriseT1059.003Windows Command ShellSub-technique

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.[6]CitationPWC Cloud Hopper Technical Annex April 2017CitationGithub AD-Pentest-Script[9] menuPass has used malicious macros embedded inside Office documents to execute files.[10][9]

EnterpriseT1005Data from Local System

menuPass has collected various files from the compromised computers.[1][8]

EnterpriseT1059.001PowerShellSub-technique

menuPass uses PowerSploit to inject shellcode into PowerShell.CitationPWC Cloud Hopper Technical Annex April 2017[8]

EnterpriseT1210Exploitation of Remote Services

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).[8]

EnterpriseT1021.004SSHSub-technique

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.[6]

EnterpriseT1119Automated Collection

menuPass has used the Csvde tool to collect Active Directory files and data.[8]

EnterpriseT1583.001DomainsSub-technique

menuPass has registered malicious domains for use in intrusion campaigns.[1][2]

EnterpriseT1574.001DLLSub-technique

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.CitationPWC Cloud Hopper Technical Annex April 2017[9][8] menuPass has also used DLL search order hijacking.[6]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0160: certutil

certutil is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. [1]

Windows
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
ToolEnterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1036: MasqueradingEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · ToolS0160: certutilEnterpriseuses · MalwareS0628: FYAntiEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · MalwareS0275: UPPERCUTEnterpriseuses · MalwareS0159: SNUGRIDEEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · MalwareS0626: P8RATEnterpriseuses · TechniqueT1090.002: External ProxyEnterpriseuses · MalwareS0153: RedLeavesEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · MalwareS0627: SodaMasterEnterpriseuses · ToolS0006: pwdumpEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1568.001: Fast Flux DNSEnterpriseuses · ToolS0002: MimikatzEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
3.0
Created
Modified
Raw hash
693c982ba7c64056...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.03.0Current bundle693c982ba7c6…
19.23.0Older bundle693c982ba7c6…
19.13.0Older bundle6295379e6c9b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    DOJ APT10 Dec 2018

    United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.

    Open source URL
  2. [2]
    District Court of NY APT10 Indictment December 2018

    US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.

    Open source URL
  3. [3]
    Palo Alto menuPass Feb 2017

    Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.

  4. [4]
    Crowdstrike CrowdCast Oct 2013

    Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem. Retrieved November 17, 2024.

    Open source URL
  5. [5]
    FireEye Poison Ivy

    FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved September 19, 2024.

    Open source URL
  6. [6]
    PWC Cloud Hopper April 2017

    PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.

    Open source URL
  7. [7]
    FireEye APT10 April 2017

    FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.

    Open source URL
  8. [8]
    Symantec Cicada November 2020

    Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.

    Open source URL
  9. [9]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  10. [10]
    Accenture Hogfish April 2018

    Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.

  11. [11]
    SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022

    Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.

    Open source URL
  12. [12]
    APT10

    (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020)

  13. [13]
    BRONZE RIVERSIDE

    (Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)

  14. [14]
    CVNX

    (Citation: PWC Cloud Hopper April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

  15. [15]
    Cicada

    (Citation: Symantec Cicada November 2020)

  16. [16]
    HOGFISH

    (Citation: Accenture Hogfish April 2018)

  17. [17]
    POTASSIUM

    (Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

  18. [18]
    Red Apollo

    (Citation: PWC Cloud Hopper April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

  19. [19]
    Stone Panda

    (Citation: Palo Alto menuPass Feb 2017)(Citation: Accenture Hogfish April 2018)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Symantec Cicada November 2020)

  20. [20]
    menuPass

    (Citation: Palo Alto menuPass Feb 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

  21. [21]
    mitre-attackG0045
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use