menuPass

Names and who uses them

• menuPassOur name
• HOGFISHAccenture
• APT10Palo Alto Networks
• Stone PandaPalo Alto Networks
• CVNXPwC
• Red ApolloPwC
• BRONZE RIVERSIDESecureworks
• CicadaSymantec
• POTASSIUMUS Department of Justice

Targets

Sectors: Government, Defence, Energy, Healthcare, Finance, Manufacturing, Aerospace, Maritime

Regions: Japan

Known techniques

• T1003.002Security Account Manager
• T1003.003NTDS
• T1003.004LSA Secrets
• T1005Data from Local System
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.004SSH
• T1027.013Encrypted/Encoded File
• T1036Masquerading
• T1036.003Rename Legitimate Utilities
• T1036.005Match Legitimate Resource Name or Location
• T1039Data from Network Shared Drive
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1055.012Process Hollowing
• T1056.001Keylogging
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1070.003Clear Command History
• T1070.004File Deletion
• T1074.001Local Data Staging
• T1074.002Remote Data Staging
• T1078Valid Accounts
• T1083File and Directory Discovery
• T1087.002Domain Account
• T1090.002External Proxy
• T1105Ingress Tool Transfer
• T1106Native API
• T1119Automated Collection
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1199Trusted Relationship
• T1204.002Malicious File
• T1210Exploitation of Remote Services
• T1218.004InstallUtil
• T1553.002Code Signing
• T1560Archive Collected Data

Malware and tools used