menuPass

Overview

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.

Targets

Government · Private sector

Regions

Australia · Brazil · Canada · Finland · France · India · Japan · Norway · South Africa · South Korea · Sweden · Switzerland · Thailand · United Kingdom · United States

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190
• Custom malware/implant development — ATT&CK: 13 attributed custom malware families

TTPs — 46 techniques across 10 tactics

Tools & malware (25)

certutil · FYAnti · UPPERCUT · SNUGRIDE · P8RAT · RedLeaves · SodaMaster · pwdump · Mimikatz · PlugX · Net · PowerSploit · ChChes · cmd · QuasarRAT · AdFind · Cobalt Strike · PoisonIvy · EvilGrab · esentutl · Impacket · Ecipekac · Ping · PsExec · HUI Loader

Reporting (3)

• BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER — Counter Threat Unit Research Team
• Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign — Symantec
• United States of America v. Zhu Hua and Zhang Shilong — United States District Court Southern District of New York (USDC SDNY)