APT10
STONE PANDAMenupass TeamhappyyongziPOTASSIUMRed ApolloCVNXHOGFISHCloud HopperBRONZE RIVERSIDEATK41G0045Granite TaurusTA429CicadaPurple TyphoonmenuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company. Source: MISP
Attributed country: CN according to MISP
Activity on Jábega · 12 weeks
1 stories · first seen on 23 Oct 2026 · last seen on 23 Oct 2026
News
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai MalwareThe Hacker News · 23 Oct 2026
Appears alongside
MITRE ATT&CK techniques
Resource Development
Initial Access
T1078Valid Accounts 82 Sigma rulesT1190Exploit Public-Facing Application 40 Sigma rulesT1199Trusted Relationship 1 Sigma rulesT1566.001Spearphishing Attachment 21 Sigma rules
Execution
T1047Windows Management Instrumentation 40 Sigma rulesT1053.005Scheduled Task 40 Sigma rulesT1059.001PowerShell 40 Sigma rulesT1059.003Windows Command Shell 40 Sigma rulesT1106Native API 12 Sigma rulesT1204.002Malicious File 32 Sigma rulesT1574.001DLL 40 Sigma rules
Privilege Escalation
Credential Access
T1003.002Security Account Manager 26 Sigma rulesT1003.003NTDS 23 Sigma rulesT1003.004LSA Secrets 12 Sigma rulesT1056.001Keylogging 3 Sigma rules
Discovery
T1016System Network Configuration Discovery 4 Sigma rulesT1018Remote System Discovery 9 Sigma rulesT1046Network Service Discovery 17 Sigma rulesT1049System Network Connections Discovery 2 Sigma rulesT1083File and Directory Discovery 17 Sigma rulesT1087.002Domain Account 19 Sigma rules
Lateral Movement
T1021.001Remote Desktop Protocol 16 Sigma rulesT1021.004SSH 5 Sigma rulesT1210Exploitation of Remote Services 14 Sigma rules
Collection
T1005Data from Local System 12 Sigma rulesT1039Data from Network Shared Drive 2 Sigma rulesT1074.001Local Data Staging 4 Sigma rulesT1074.002Remote Data StagingT1119Automated Collection 5 Sigma rulesT1560Archive Collected Data 11 Sigma rulesT1560.001Archive via Utility 10 Sigma rules
Command and Control
T1090.002External Proxy 2 Sigma rulesT1105Ingress Tool Transfer 40 Sigma rulesT1568.001Fast Flux DNS
Stealth
T1027.013Encrypted/Encoded FileT1036Masquerading 88 Sigma rulesT1036.003Rename Legitimate Utilities 25 Sigma rulesT1036.005Match Legitimate Resource Name or Location 20 Sigma rulesT1070.003Clear Command History 9 Sigma rulesT1070.004File Deletion 9 Sigma rulesT1140Deobfuscate/Decode Files or Information 17 Sigma rulesT1218.004InstallUtil
Defense impairment
Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy, MITRE ATT&CK and SigmaHQ. attack.mitre.org ↗