menuPass

{
  "id": "ATTACK:enterprise:G0045",
  "title": "menuPass",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0045",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--222fbd21-fc4f-4b7e-9f85-0e6e3a76c33f",
  "external_id": "G0045",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:09.054Z",
  "modified": "2026-07-31T18:47:42.898Z",
  "version": "3.0",
  "aliases": [
    "menuPass",
    "Cicada",
    "POTASSIUM",
    "Stone Panda",
    "APT10",
    "Red Apollo",
    "CVNX",
    "HOGFISH",
    "BRONZE RIVERSIDE"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "HOGFISH"
    },
    {
      "source_name": "POTASSIUM"
    },
    {
      "source_name": "Stone Panda"
    },
    {
      "source_name": "APT10"
    },
    {
      "source_name": "menuPass"
    },
    {
      "source_name": "Red Apollo"
    },
    {
      "source_name": "CVNX"
    },
    {
      "source_name": "BRONZE RIVERSIDE"
    },
    {
      "source_name": "Cicada"
    },
    {
      "source_name": "Accenture Hogfish April 2018",
      "url": "http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"
    },
    {
      "source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
      "url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
    },
    {
      "source_name": "Crowdstrike CrowdCast Oct 2013",
      "url": "https://www.slideshare.net/slideshow/crowd-casts-monthly-you-have-an-adversary-problem/27262315"
    },
    {
      "source_name": "FireEye APT10 April 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"
    },
    {
      "source_name": "FireEye Poison Ivy",
      "url": "https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf"
    },
    {
      "source_name": "FireEye APT10 Sept 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
    },
    {
      "source_name": "Palo Alto menuPass Feb 2017",
      "url": "http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"
    },
    {
      "source_name": "PWC Cloud Hopper April 2017",
      "url": "https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"
    },
    {
      "source_name": "Symantec Cicada November 2020",
      "url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"
    },
    {
      "source_name": "DOJ APT10 Dec 2018",
      "url": "https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"
    },
    {
      "source_name": "District Court of NY APT10 Indictment December 2018",
      "url": "https://www.justice.gov/opa/page/file/1122671/download"
    }
  ]
}