menuPass

MenuPass, also known as APT10, Stone Panda, and ChessMaster, is a threat actor suspected to be sponsored by the Chinese government. This group has been active since at least 2006, primarily targeting sectors such as construction and engineering, aerospace, telecom firms, and governments in the United States, Europe, and Japan. The cybersecurity firm Mandiant has tracked the group's activities since 2009, with additional tracking conducted by Trend Research. MenuPass employs sophisticated tactics including living-off-the-land techniques, custom fileless malware, anti-analysis tactics, and exploitation of trusted third-party relationships for credential access. The group's signature behaviors were used by MITRE Engenuity to emulate a multi-subsidiary compromise focusing on defense evasion, exploiting trusted relationships, data encryption, and inhibiting system recovery. Furthermore, MenuPass was linked to the development of Trochilus, an advanced persistent threat tool, by researchers from NHS Digital in the UK. CrowdStrike Counter Adversary Operations also identified that the MITRE ATT&CK Evaluations for Managed Services emulated the behavior of MenuPass, alongside another adversary, ALPHA SPIDER (also known as ALPHV BlackCat). Defending against threat actors like MenuPass and ALPHV/BlackCat requires a combination of advanced cybersecurity tools and leading threat intelligence. These groups use well-known tactics, techniques, and procedures (TTPs), making them somewhat predictable for those familiar with their methods. Notably, Trend Micro had an advantage during an evaluation due to its long-term study of both MenuPass and ALPHV/BlackCat, which allowed them to amass deep insights to inform its managed detection and response defenses. As state-sponsored cyber espionage groups, both MenuPass and ALPHV/BlackCat are continually adapting their targets based on their sponsors' interests.