menuPass

menuPass, most widely known as APT10, is a China-linked, state-sponsored cyberespionage threat actor active since at least 2009. The group is described as targeting entities considered strategically important to the Chinese state and has conducted global espionage operations against organizations in healthcare, defense, aerospace, finance, maritime, biotechnology, energy, government, legal, religious, NGO, telecom, and pharmaceutical sectors across Europe, Asia, and North America. Known aliases in the provided content include Aeon, BRONZE RIVERSIDE, CHCHES, Cicada, CVNX, EvilGrab, Foxmail, Foxtrot, Golem, Haymaker, Hogfish, LiveSafe, MenuPass, Potassium, Purple Typhoon, Red Apollo, Stone Panda, and WebMonder. The content also states that MirrorFace is now assessed as a subgroup under the APT10 umbrella. Observed tradecraft in the provided content includes spearphishing with malicious Microsoft Office documents and LNK files; use of harvested credentials; possible exploitation of unpatched Microsoft Exchange vulnerabilities for initial access in some intrusions; DLL sideloading; reflective code loading and other fileless execution techniques; credential dumping; Active Directory enumeration and export using csvde.exe/Csvde; use of certutil, including certutil -decode, to decode Base64-encoded payloads; reconnaissance with NBTScan and NetBIOS enumeration; remote execution with WMIExec; remote control with WinVNC; and likely staging or exfiltration using RAR. The group has searched compromised systems for folders of interest including HR, audit and expense, and meeting memos. Malware and tooling directly associated with the group in the content include SigLoader, FYAnti, P8RAT, Impacket, QuasarRAT, SodaMaster, a custom loader, a custom Mimikatz loader, UPPERCUT, and LODEINFO. In one described execution chain, SigLoader decrypts and loads FYAnti in memory, and FYAnti decrypts an embedded .NET module and reflectively loads it using the CppHostCLR technique. The content also states that APT10 used DLL sideloading to deliver the LODEINFO backdoor for cyberespionage. Symantec attributed a long-running campaign to Cicada/APT10 based on use of a custom loader and SodaMaster, which the content says was believed to be exclusively used by the group at that time. The group is linked in the content to Chinese state interests and espionage objectives.