menuPass / APT10 / Stone Panda (also known as APT10, Stone Panda, CVNX, Red Apollo, POTASSIUM) is a state-sponsored advanced persistent threat group attributed to China (MSS / Tianjin Bureau), active since 2006. The group primarily targets MSPs, healthcare, defense, aerospace globally sectors. It is tracked by MITRE ATT&CK as G0045.
Overview & Attribution
China MSS-affiliated APT targeting managed service providers to pivot into client networks, conducting massive intellectual property theft across defense, healthcare, and aerospace sectors.
menuPass has been active since 2006, attributed to China (MSS / Tianjin Bureau). The group is known for targeting MSPs, healthcare, defense, aerospace globally using a combination of custom malware, living-off-the-land techniques, and sophisticated social engineering.
- Attribution: China (MSS / Tianjin Bureau)
- Active since: 2006
- Primary targets: MSPs, healthcare, defense, aerospace globally
- Also known as: APT10, Stone Panda, CVNX, Red Apollo, POTASSIUM
Arsenal & Tools
menuPass employs a diverse arsenal of custom and shared tooling:
- Quasar RAT: Custom/shared tooling used in operations
- PlugX: Custom/shared tooling used in operations
- ChChes: Custom/shared tooling used in operations
- ANEL: Custom/shared tooling used in operations
- SodaMaster: Custom/shared tooling used in operations
Targeting & Operations
The group focuses on MSPs, healthcare, defense, aerospace globally sectors, with operations spanning multiple geographic regions. Their campaigns typically involve carefully crafted spearphishing, strategic watering holes, and exploitation of public-facing applications.
menuPass is characterized by persistent, long-term access operations. Once inside a target network, the group establishes multiple redundant persistence mechanisms and moves laterally to high-value systems before beginning data exfiltration.
MITRE ATT&CK Mapping
| Tactic | Technique | Usage |
|---|---|---|
| Initial Access | T1199 Trusted Relationship | MSP compromise for client access |
| Execution | T1059.001 PowerShell | PowerShell post-exploitation |
| Persistence | T1053.005 Scheduled Task | Task-based persistence |
| Defense Evasion | T1055 Process Injection | DLL injection |
| Credential Access | T1003.001 LSASS Memory | Credential dumping |
| C2 | T1071.001 Web Protocols | HTTP/HTTPS C2 |
Notable Campaigns
menuPass has been linked to multiple significant campaigns targeting MSPs, healthcare, defense, aerospace globally organizations. The group continuously evolves its tooling and infrastructure to evade detection while maintaining persistent access to compromised networks.
- Long-term espionage: Multi-year intrusions into government and defense networks
- Supply chain targeting: Compromise of technology providers and managed service providers
- Zero-day exploitation: Use of previously unknown vulnerabilities for initial access
Detection & Defense
- Threat intelligence integration: Monitor for known menuPass IOCs and TTPs in SIEM/EDR platforms
- Network monitoring: Detect C2 patterns associated with Quasar RAT and related tooling
- Email security: Implement advanced phishing detection for spearphishing campaigns
- Endpoint detection: Deploy behavioral detection rules for known menuPass TTPs
- Patch management: Prioritize patching of vulnerabilities known to be exploited by this group
- Lateral movement detection: Monitor for suspicious authentication patterns and admin tool usage
Defend Against menuPass
Mjolnir Security provides specialized capabilities to detect and respond to menuPass operations.
- APT Threat Hunting Proactive hunting for menuPass TTPs, tooling artifacts, and infrastructure indicators within your environment.
- Threat Intelligence Continuous monitoring of menuPass campaigns and infrastructure changes with actionable intelligence for your defense team.
- 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts