menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.1011
group
menuPass G0045
- Created
- 31 May 2017
- Last modified
- 31 July 2026
- Aliases
- menuPass · Cicada · POTASSIUM · Stone Panda · APT10 · Red Apollo · CVNX · HOGFISH · BRONZE RIVERSIDE
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][8][9]
46
TechniquesTop 18%
12
Tactics73rd pct
25
Tools & malwareTop 4%
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0045
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.1314
menuPass has collected various files from the compromised computers.1516
menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.17
menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.1819
Standing G0045
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques46Top 18%
82nd percentile · 82% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics1273rd pct
73rd percentile · 73% of 176 ATT&CK groups have this many tactics spanned or fewer.
Tools & malware25Top 4%
96th percentile · 96% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique24med60th pct
60th percentile · 60% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique4.5med
Detection coverage G0045
1677 distinct rules cover the 46 techniques recorded for this group. The 1880 technique-to-rule mappings resolve to 1677 distinct rules, because one rule can cover several techniques. 1120 Sigma · 557 Splunk.
43 covered by at least one rule3 with no coverage1677 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org