menuPass

MenuPass, also known as APT10, Stone Panda, and ALPHV BlackCat, is a threat actor suspected to be linked to the Chinese government. This cyber espionage group has been active since at least 2009, according to Mandiant, and has targeted a wide range of sectors including construction, engineering, aerospace, telecom firms, and governments across the United States, Europe, and Japan. The group's tactics include spear phishing, with careful social engineering to ensure the legitimacy of their attacks. MenuPass has shown persistence in its attempts to compromise targets, repeatedly targeting the same organizations and individuals, particularly in Japan, since 2014. The group is known for developing the Trochilus malware, as identified by researchers from NHS Digital in the UK. They have also used other tools such as PIVY and ChChes malware family in their campaigns. The PIVY samples were found to use passwords such as "menuPass" and "keaidestone," further linking these attacks to the group. The ChChes malware shares an import hash with other tools used by MenuPass, providing additional evidence of the group's involvement. MenuPass continues to pose a significant threat due to its ongoing advanced persistent threat (APT) campaign, broad target range, and likely continued focus on Japan. Their persistent efforts and evolving techniques underscore the importance of robust cybersecurity measures and vigilance in detecting and mitigating such threats. Furthermore, the group's activities highlight the increasing sophistication and potential state sponsorship of cyber-espionage activities, necessitating a coordinated international response to address this challenge.