menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.12 menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.3456789
- DOJ APT10 Dec 2018
- District Court of NY APT10 Indictment December 2018
- Palo Alto menuPass Feb 2017
- Crowdstrike CrowdCast Oct 2013
- FireEye Poison Ivy
- PWC Cloud Hopper April 2017
- FireEye APT10 April 2017
- DOJ APT10 Dec 2018
- District Court of NY APT10 Indictment December 2018
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1106 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1039 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1003.004 | LSA Secrets | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1036 | Masquerading | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1039 | Data from Network Shared Drive | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1055.012 | Process Hollowing | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1070.003 | Clear Command History | — |
| T1070.004 | File Deletion | — |
| T1074.001 | Local Data Staging | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1090.002 | External Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1106 | Native API | — |
| T1119 | Automated Collection | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1199 | Trusted Relationship | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1218.004 | InstallUtil | — |
| T1553.002 | Code Signing | — |
| T1560 | Archive Collected Data | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1568.001 | Fast Flux DNS | — |
| T1574.001 | DLL | — |
| T1583.001 | Domains | — |
| T1588.002 | Tool | — |
别名
APT10 · BRONZE RIVERSIDE · Cicada · CVNX · HOGFISH · menuPass · POTASSIUM · Red Apollo · Stone Panda
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。