Overview 1,500 indicators
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.
| domain | 1,487 | G0045-domain.txt |
| ipv4 | 11 | G0045.json |
| url | 2 | G0045.json |
Techniques 46 ATT&CK
Open in ATT&CK Navigator → or download the layer (46 techniques, layer 4.5)
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1027.013 Encrypted/Encoded File
- T1036 Masquerading
- T1036.003 Rename Legitimate Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1039 Data from Network Shared Drive
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1055.012 Process Hollowing
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1070.003 Clear Command History
- T1070.004 File Deletion
- T1074.001 Local Data Staging
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1083 File and Directory Discovery
- T1087.002 Domain Account
- T1090.002 External Proxy
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1119 Automated Collection
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1210 Exploitation of Remote Services
- T1218.004 InstallUtil
- T1553.002 Code Signing
- T1560 Archive Collected Data
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1568.001 Fast Flux DNS
- T1574.001 DLL
- T1583.001 Domains
- T1588.002 Tool
Software 25
- Mimikatz
- pwdump
- PoisonIvy
- PlugX
- PsExec
- Net
- Ping
- cmd
- ChChes
- EvilGrab
- RedLeaves
- Cobalt Strike
- SNUGRIDE
- certutil
- PowerSploit
- QuasarRAT
- UPPERCUT
- Impacket
- esentutl
- AdFind
- Ecipekac
- P8RAT
- SodaMaster
- FYAnti
- HUI Loader
Principal sources 49 reports
Ranked by how many of this actor's indicators each report brought in.
- 1,375github.com/janhenrikdotcom/iocs/blob/master/APT10/…
- 1,375raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar
- 154github.com/pan-unit42/iocs/blob/master/menuPass
- 26researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-mal…
- 14ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks…
- 14unit42.paloaltonetworks.com/pingpull-gallium
- 14virustotal.com/gui/file/861abfc3ca4e8b450afdc33af68921…
- 10blog.jpcert.or.jp/2017/02/chches-malware--93d6.html
Related groups 3
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 1,500 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
Showing the 300 most recent of 1,500. Complete: G0045.json.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
virustotal.com/gui/ip-address/89.117.79.31/relations · virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde… · virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ad… · virustotal.com/gui/file/661f649f83451c344879cebcc7d56d… · virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b…
domain win32updates.duckdns.org domain windows-11.duckdns.org domain windows-com.duckdns.org domain windows-defender.com ipv4 31.220.92.125:11 ipv4 89.117.79.31:3 -
x.com/skocherhan/status/1901765548670955804 · virustotal.com/gui/file/5896dbc54fe973c18bc0a4505f4a8c…
domain serviceusa.duckdns.org ipv4 89.117.79.31:100 -
x.com/malwrhunterteam/status/1924559400242454… · virustotal.com/gui/file/0a4888750a50461effd10757fc9beb…
domain myststemsgame.com ipv4 89.117.79.31:88 -
trendmicro.com/en_us/research/25/d/earth-kasha-updates… · documents.trendmicro.com/images/TEx/Earth-Kasha-Blog-IoCshFxTmpo…
kyolpon.com srmbr.net -
unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government · otx.alienvault.com/pulse/651aca1636127242b4dd6af9
cdn-sina.tw -
community.emergingthreats.net/t/ruleset-update-summary-2024-12-02-v10…
srmbr.com tw8sl.com -
1275.ru/ioc/8083/earth-kasha-apt10-apt-iocs
ns1.tlsart.com tlsart.com ww12.tlsart.com -
github.com/janhenrikdotcom/iocs/blob/master/APT10/… · raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar
fuck.wikaba.com -
blog-en.itochuci.co.jp/entry/2024/01/24/134100 · otx.alienvault.com/pulse/65b7c5ce83210bf49833afdd
ipv4 45.76.222.130:443 ipv4 45.77.183.161:443 url http://45.76.222.130 url http://45.77.183.161 -
virustotal.com/gui/ip-address/89.117.79.31/relations · virustotal.com/gui/file/0b798ce8880a01eaf5496830e31cde… · virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ad… · virustotal.com/gui/file/661f649f83451c344879cebcc7d56d… · virustotal.com/gui/file/62c4d17c1e5ed099efcbd26725837b…
89.117.79.31:2 -
unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government · otx.alienvault.com/pulse/651aca1636127242b4dd6af9
images.cdn-sina.tw shell.cdn-sina.tw -
twitter.com/malwrhunterteam/status/1659534793124593… · virustotal.com/gui/file/70c4600d6920dadc1899603b131119…
info.publicvm.com -
unit42.paloaltonetworks.com/alloy-taurus · virustotal.com/gui/file/5ba043c074818fdd06ae1d3939ddfe… · virustotal.com/gui/file/cb0922d8b130504bf9a30787432947…
domain saspecialforces.co.za domain vpn729380678.softether.net domain yrhsywu2009.zapto.org ipv4 204.79.197.200:8443 ipv4 5.181.25.99:8443 -
ics-cert.kaspersky.com/publications/reports/2022/06/27/attacks…
cargobussiness.site defineyourid.site documents.kankuedu.org grandfoodtony.com houwags.defineyourid.site kankuedu.org live.musicweb.xyz musicweb.xyz noub.crabdance.com obj.services obo.videocenter.org order.cargobussiness.site tech.obj.services videocenter.org -
unit42.paloaltonetworks.com/pingpull-gallium · virustotal.com/gui/file/861abfc3ca4e8b450afdc33af68921…
domain df.micfkbeljacob.com domain goodjob36.publicvm.com domain goodluck23.jp.us domain helpinfo.publicvm.com domain hinitial.com domain jack.micfkbeljacob.com domain mailedc.publicvm.com domain micfkbeljacob.com domain t1.hinitial.com domain v2.hinitial.com domain v3.hinitial.com domain v4.hinitial.com domain v5.hinitial.com ipv4 61.221.66.85:8080 -
jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yana… · otx.alienvault.com/pulse/601832343e90a9658287a666
rare-coisns.com -
twitter.com/KorbenD_Intel/status/1243668874102321152 · otx.alienvault.com/indicator/ip/185.117.88.80
185.117.88.80:8088 -
twitter.com/Vishnyak0v/status/1239908264831311872 · twitter.com/Vishnyak0v/status/1239908305117552644 · ptsecurity.com/ru-ru/research/pt-esc-threat-intelligen…
oseupdate.dns-dns.com yandex2unitedstated.dns05.com yandex2unitedstated.dynamic-dns.net -
github.com/pan-unit42/iocs/blob/master/menuPass
abcd100621.3322.org amsidgoo.thedomais.info arkouowi.com babyprintf.2288.org bulk.tmpxctl.com contacts.rvenee.com creatos.kozow.com davidgagnon.org diamond.ninth.biz domain.casacam.net ducksow.ddnsgeek.com firtstdata.kozow.com forward.davidgagnon.org grandeur.kozow.com herring.kozow.com img.microtoo.info info.uroljp.com iu.niushenghuo.info js001.3322.org malware.DSMTP.COM meibubaker.3322.org microtoo.info resource.arkouowi.com rvenee.com services.arkouowi.com sh.chromeenter.com sstday.Jkub.com tmpxctl.com trasul.myPicture.info trems.rvenee.com unspa.hostport9.net uroljp.com usa.radiorig.com vm.vmdnsup.org voov.2288.org web.casacam.net weile3322a.3322.org weile3322b.3322.org yz.chromeenter.com zone.usrobothome.com -
cybereason.com/blog/operation-soft-cell-a-worldwide-ca… · microsoft.com/security/blog/2019/12/12/gallium-target… · otx.alienvault.com/pulse/5d120d47d09d67b4d8dc5241
asyspy256.ddns.net cvdfhjh1231.ddns.net cvdfhjh1231.myftp.biz cvdfhjh12311.ddns.net dffwescwer4325.myftp.biz hotkillmail9sddcc.ddns.net rosaf112.ddns.net sz2016rose.ddns.net -
otx.alienvault.com/pulse/5ce7e40de8145f2cd9272a4e · blog.ensilo.com/uncovering-new-activity-by-apt10
caibi379.com kaspresksy.com microsofts.org miscrosofts.com tencentchat.net -
unit42.paloaltonetworks.com/menupass-playbook-and-iocs · github.com/pan-unit42/iocs/blob/master/menuPass
keyscratch.com -
accenture.com/t20180423T055005Z__w__/us-en/_acnmedia/… · github.com/pan-unit42/iocs/blob/master/menuPass
algorithm.ddnsgeek.com firefoxcomt.arkouowi.com friendlysupport.giize.com -
accenture.com/t20180423T055005Z__w__/us-en/_acnmedia/…
update.arkouowi.com -
fireeye.com/blog/threat-research/2018/09/apt10-targ…
eservake.jetos.com -
brica.de/alerts/alert/public/1214983/apt10-using… · otx.alienvault.com/pulse/5b02d669f283a83d0cc4e7b5 · github.com/pan-unit42/iocs/blob/master/menuPass
jadl-or.com -
github.com/janhenrikdotcom/iocs/blob/master/APT10/… · raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar
002562066559681.r3u8.com 031168053846049.r3u8.com 0625.have8000.com 1.gadskysun.com 100fanwen.com 11.usyahooapis.com 19518473326.r3u8.com 1960445709311199.r3u8.com 1z.itsaol.com 2012yearleft.com 202017845.r3u8.com 2139465544784.r3u8.com 2789203959848958.r3u8.com 5590428449750026.r3u8.com 5q.niushenghuo.info 6r.suibian2010.info 9gowg.tech a.wubangtu.info a1.suibian2010.info ab.4pu.com abc.wikaba.com abcd120807.3322.org acc.emailfound.info acc.lehigtapp.com acsocietyy.com ad.getfond.info ad.webbooting.com additional.sexidude.com af.zyns.com afc.https443.org ako.ddns.us androidmusicapp.onmypc.us announcements.toythieves.com anvprn.com apec.qtsofta.com apple.defensewar.org appledownload.ourhobby.com appleimages.itemdb.com appleimages.longmusic.com applemirror.organiccrap.com applemirror.squirly.info applemusic.isasecret.com applemusic.itemdb.com applemusic.wikaba.com applemusic.xxuz.com applemusic.zzux.com apples.sytes.net appleupdate.itemdb.com architectisusa.com asfzx.x24hr.com availab.wikaba.com availability.justdied.com ba.my03.com baby.myie12.com baby.usmirocomney.net back.jungleheart.com back.mofa.dynamic-dns.net bak.un.dnsrd.com balance1.wikaba.com balk.n7go.com banana.cmdnetview.com barrybaker.6600.org bbs.jungleheart.com bdoncloud.com be.mrslove.com bethel.webhop.net bexm.cleansite.biz bezu.itemdb.com blaaaaaaaaaaaa.windowsupdate.3-a.net blog.defensewar.org brand.fartit.com bridgeluxlightmadness.com bulletproof.squirly.info cata.qtsofta.com catholicmmb.com cc.dynamicdns.co.uk ccupdatedata.authorizeddns.net cd.usyahooapis.com cdn.incloud-go.com center.shenajou.com cgei493860.r3u8.com chaindungeons.com chibashiri.com childrenstow.com cia.ezua.com ciaoci.chickenkiller.com civilwar123.authorizeddns.org civilwar520.onmypc.org ckusshani.com cloud-kingl.com cloudns.8800.org cms.sindeali.com cnnews.mylftv.com commissioner.shenajou.com commons.onedumb.com contactus.myddns.com contactus.onmypc.us contract.4mydomain.com contractus.zzux.com coreck.suayay.com cs.lflink.com ctdl.windowsupdate.itsaol.com ctdl.windowsupdate.nsatcdns.com ctldl.appledownload.ourhobby.com ctldl.applemusic.itemdb.com ctldl.itunesmusic.jkub.com ctldl.microsoftmusic.onedumb.com ctldl.microsoftupdate.qhigh.com ctldl.windowsupdate.authorizeddns.org ctldl.windowsupdate.authorizeddns.us ctldl.windowsupdate.dnset.com ctldl.windowsupdate.esmtp.biz ctldl.windowsupdate.ezua.com ctldl.windowsupdate.gettrials.com ctldl.windowsupdate.itsaol.com ctldl.windowsupdate.lflinkup.com ctldl.windowsupdate.mrface.com ctldl.windowsupdate.nsatcdns.com ctldl.windowsupdate.organiccrap.com ctldl.windowsupdate.x24hr.com cwiinatonal.com daddy.gostudyantivirus.com dcc.jimingroup.com dd.ddns.us de.onmypc.info dear.loveddos.com dec.seyesb.acmetoy.com dedgesuite.net defensewar.org demoones.com department.shenajou.com details.squirly.info development.shenajou.com devilcase.acmetoy.com dfgwerzc.3322.org digsby.ourhobby.com disruptive.https443.net dlmix.ourdvs.com dnspoddwg.authorizeddns.org do.ddns.ms document.shenajou.com domainnow.yourtrap.com download.applemusic.itemdb.com download.microsoftmusic.onedumb.com download.windowsupdate.authorizeddns.org download.windowsupdate.dedgesuite.net download.windowsupdate.dnset.com download.windowsupdate.itsaol.com download.windowsupdate.lflinkup.com download.windowsupdate.nsatcdns.com download.windowsupdate.x24hr.com downloadlink.mypicture.info dst.1dumb.com duosay.com dyncojinf.6600.org dynsbluecheck.7766.org ea.onmypc.info ea.rebatesrule.net edgar.ccfchrist.com ehshiroshima.mylftv.com eric-averyanov.wha.la essashi.com eu.acmetoy.com eu.wha.la eu.zzux.com everydayfilmlink.com ewe.toshste.com eweek.2waky.com exprenum.com express.lflinkup.com extraordinary.dynamic-dns.net f068v.site fabian.ccfchrist.com fastemail.dnsrd.com fastmail2.com · 1,083 more in this batch, in the JSON
Further reading 59
- researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-mal…
- web.archive.org/web/20220810112638/https:/www.accenture…
- attack.mitre.org/groups/G0045
- symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-…
- web.archive.org/web/20220224041316/https:/www.pwc.co.uk…
- fireeye.com/blog/threat-research/2017/04/apt10_menu…
- fireeye.com/blog/threat-research/2018/09/apt10-targ…
- justice.gov/opa/page/file/1122671/download
- justice.gov/opa/pr/two-chinese-hackers-associated-m…
- mandiant.com/sites/default/files/2021-09/rpt-poison-…
- secureworks.com/research/bronze-starlight-ransomware-op…
- slideshare.net/slideshow/crowd-casts-monthly-you-have-…
- unit42.paloaltonetworks.com/menupass-playbook-and-iocs
- otx.alienvault.com/indicator/ip/185.117.88.80
- blog-en.itochuci.co.jp/entry/2024/01/24/134100
- brica.de/alerts/alert/public/1214983/apt10-using…
- microsoft.com/security/blog/2019/12/12/gallium-target…
- unit42.paloaltonetworks.com/alloy-taurus
- otx.alienvault.com/pulse/5b02d669f283a83d0cc4e7b5
- virustotal.com/gui/ip-address/89.117.79.31/relations
- github.com/pan-unit42/iocs/blob/master/menuPass
- virustotal.com/gui/file/5896dbc54fe973c18bc0a4505f4a8c…
- virustotal.com/gui/file/861abfc3ca4e8b450afdc33af68921…
- virustotal.com/gui/file/661f649f83451c344879cebcc7d56d…
- virustotal.com/gui/file/cb0922d8b130504bf9a30787432947…
- unit42.paloaltonetworks.com/alloy-taurus-targets-se-asian-government
- ptsecurity.com/ru-ru/research/pt-esc-threat-intelligen…
- virustotal.com/gui/file/5ba043c074818fdd06ae1d3939ddfe…
- otx.alienvault.com/pulse/5d120d47d09d67b4d8dc5241
- twitter.com/malwrhunterteam/status/1659534793124593…
- virustotal.com/gui/file/117b4adb50bb27641f732f7e8b70ad…
- x.com/malwrhunterteam/status/1924559400242454…
- github.com/janhenrikdotcom/iocs/blob/master/APT10/…
- jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yana…
- raw.githubusercontent.com/jonaslejon/apt10/master/apt_apt10.yar
- otx.alienvault.com/pulse/601832343e90a9658287a666
- trendmicro.com/en_us/research/25/d/earth-kasha-updates…
- twitter.com/Vishnyak0v/status/1239908264831311872
- blog.jpcert.or.jp/2017/02/chches-malware--93d6.html
- cybereason.com/blog/operation-soft-cell-a-worldwide-ca…
19 more, and the report behind every indicator, in G0045.json.