Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers.
In short
Attributed by the US, UK and EU governments to a China-based group working with the Ministry of State Security, menuPass (APT10) is known for reaching companies through their managed service providers. The US charged two people in December 2018 and the EU listed two people and a company in July 2020.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| menuPass | MITRE ATT&CK group name; "MenuPass" in the US press release of 20 December 2018 and the EU Council decision of 30 July 2020[1, 2, 11] |
| APT10 | MITRE ATT&CK Associated Groups; US press release; UK NCSC; CISA; EU Council decision[1, 2, 5, 7, 8, 11] |
| Stone Panda | MITRE ATT&CK Associated Groups; US press release; UK NCSC; EU Council decision[1, 2, 5, 11] |
| Red Apollo | MITRE ATT&CK Associated Groups; US press release; UK NCSC; EU Council decision[1, 2, 5, 11] |
| CVNX | MITRE ATT&CK Associated Groups; US press release; EU Council decision (the US indictment also lists it as an alias of defendant Zhu Hua)[1, 2, 3, 11] |
| POTASSIUM | MITRE ATT&CK Associated Groups; US press release; EU Council decision[1, 2, 11] |
| Cicada | MITRE ATT&CK Associated Groups only[1] |
| HOGFISH | MITRE ATT&CK Associated Groups only[1] |
| BRONZE RIVERSIDE | MITRE ATT&CK Associated Groups only[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK Page version 3.0, last modified 31 July 2026
Says individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's Tianjin State Security Bureau and worked for Huaying Haitai. Lists the group as active since at least 2006.[1]
US Department of Justice (Southern District of New York) 20 December 2018
Charged Zhu Hua and Zhang Shilong with conspiracy to commit computer intrusions, conspiracy to commit wire fraud and aggravated identity theft. Says they were members of the APT10 Group and acted in association with the Tianjin State Security Bureau. These are allegations; the defendants are presumed innocent.[2, 3]
UK Foreign Office and NCSC 20 December 2018
The NCSC assessed with the highest level of probability that APT 10 is responsible for the campaign. The UK government judged that the Chinese Ministry of State Security was responsible. It said this was the first time the UK had publicly named elements of the Chinese government for a cyber campaign.[4]
UK NCSC 20 December 2018
Describes APT10 as a threat actor acting on behalf of the Chinese Ministry of State Security, active since at least 2009, and warns of activity against UK organizations that is likely by APT10.[5, 6]
CISA 20 December 2018
Updated its alert TA17-117A to add the US Government's attribution of the activity to Chinese cyber actors associated with the Chinese Ministry of State Security.[7]
CISA 1 October 2020 (initial version)
Lists the December 2018 indictment of two people believed to be associated with APT10, and describes APT10 (MenuPass Group) as reaching victims through compromised service providers.[8]
EU Council 30 July 2020
Listed Gao Qiang, Zhang Shilong and the company Huaying Haitai under its cyber sanctions regime for Operation Cloud Hopper, and says the actor publicly known as APT10 carried it out.[11, 12]
CISA and Canadian Cyber Centre CISA page last revised 30 June 2020; no date on the saved Canadian page
Both say APT10 uses Quasar RAT against a broad range of sectors, in a joint report on publicly available tools.[9, 10]
Sources differ on how the group relates to the Ministry of State Security. The US press release of 20 December 2018 says the two defendants acted "in association with" the Tianjin State Security Bureau. MITRE uses similar words. The UK of the same date says APT 10 acted on behalf of the Ministry and that it was highly likely to have an enduring relationship with it. The EU listing texts of 30 July 2020 do not name the Ministry. Sources also differ on the start year. MITRE and the US press release say 2006. The NCSC says at least 2009. For the managed service provider campaign, the US says at least 2014, while CISA says at least May 2016 and the UK says at least 2016.
Each entry is attributed to the group by the sources cited.
The UK NCSC says the group is known to have been active since at least 2009.[5]
The US alleges the intrusion campaign against managed service providers began at least in or about 2014.[2]
CISA says it saw a campaign occurring since at least May 2016, using multiple malware implants and stolen administrator credentials.[7]
MITRE says the group targeted MSPs, manufacturing and mining companies, and a university in 2016 and 2017.[1]
The NCSC published guidance to mitigate the campaign against MSPs.[4]
CISA posted alert TA17-117A describing the campaign.[7]
The NCSC issued version 1.0 of its APT10 report to its information sharing platform with a TLP AMBER handling caveat.[5]
MITRE cites the indictment United States v. Zhu Hua and Zhang Shilong as dated 17 December 2018.[1]
CISA advisory AA20-275A lists APT10 (MenuPass Group) as an example of Chinese actors using service providers.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 3 April 2017 | UK NCSC | GuidancePublished guidance to mitigate the campaign targeting managed service providers.[4] |
| 27 April 2017 | CISA | AlertPosted alert TA17-117A on intrusions affecting multiple victims across multiple sectors.[7] |
| 29 August 2018 | UK NCSC | Advisory to partnersIssued version 1.0 of its APT10 report to its information sharing platform, marked TLP AMBER.[5] |
| 20 December 2018 | US Department of Justice (Southern District of New York), with FBI, DCIS and NCIS | Indictment unsealedCharged Zhu Hua and Zhang Shilong with conspiracy to commit computer intrusions, conspiracy to commit wire fraud and aggravated identity theft.[2, 3] |
| 20 December 2018 | UK Foreign Office and NCSC | Public attributionSaid the NCSC assessed APT 10 as responsible for the campaign and that the UK judged the Chinese Ministry of State Security responsible.[4] |
| 20 December 2018 | UK NCSC | AdvisoryPublished version 2.0 of its APT10 alert with updated mitigation advice.[5, 6] |
| 20 December 2018 | CISA | Alert updatedAdded the US attribution to Chinese cyber actors associated with the Ministry of State Security to alert TA17-117A.[7] |
| 30 July 2020 | EU Council | SanctionsListed Gao Qiang, Zhang Shilong and Tianjin Huaying Haitai Science and Technology Development Co. Ltd for Operation Cloud Hopper.[11, 12] |
| 1 October 2020 | CISA | AdvisoryPublished AA20-275A, which names APT10 (MenuPass Group) and recaps the 2018 indictment.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Trusted Relationship T1199
Uses access granted to managed service providers to reach the providers' clients.[1, 2, 6]
Phishing: Spearphishing Attachment T1566.001
Sends malicious Office documents and disguised executables by email.[1, 3]
Exploit Public-Facing Application T1190
MITRE notes use of Pulse Secure VPN flaws. The NCSC says known flaws in commercial web applications were used to reach a web server.[1, 6]
Valid Accounts T1078
Uses valid accounts, including ones shared between providers and clients, and stolen administrator credentials.[1, 2, 7]
User Execution: Malicious File T1204.002
Tries to get victims to open shortcut files and Office documents sent in spearphishing emails.[1]
Command and Scripting Interpreter: PowerShell T1059.001
MITRE says the group uses PowerSploit to inject shellcode into PowerShell. CISA describes heavy use of PowerShell and PowerSploit.[1, 7]
PlugX Remote access tool
MITRE describes it as a remote access tool with modular plugins used by multiple groups. The US indictment and CISA name it in this activity.[1, 3, 7, 20]
RedLeaves Malware
MITRE describes a malware family used by menuPass whose code overlaps with PlugX. CISA calls it the most unique implant in its campaign.[3, 7, 19]
QuasarRAT Remote access tool
An open-source tool. The NCSC alert of December 2018 says it was the main malware seen in UK activity. The US indictment also names it.[3, 6, 21]
PoisonIvy Remote access tool
The US indictment says spear phishing installed customized variants of Poison Ivy. MITRE lists it for the group.[1, 3, 24]
UPPERCUT Backdoor
MITRE describes a 32-bit HTTP-based backdoor used by menuPass since at least 2017.[22]
EvilGrab Malware
MITRE says menuPass delivered it in malicious Office documents sent in spearphishing campaigns.[1, 23]
Cobalt Strike Penetration testing tool
The NCSC says phishing was used to deliver it, mainly in activity focused on Japan. MITRE lists it for the group.[1, 6]
PowerSploit Open-source toolkit
CISA reports heavy use of PowerShell and PowerSploit for reconnaissance and lateral movement.[1, 7]
Also linked in our threat library:
Ask your managed service providers how they protect their own access to your systems. Require multi-factor authentication for delegated administrator accounts, manage the accounts they use, and be ready to cut off third-party remote access during an incident.
Patch exposed web applications and VPN products quickly, scan external systems for flaws, and remove public services that do not need to be public.
Counters T1190
Follow what governments and MITRE report about this group and compare its listed techniques with your own controls.
See which web applications, VPNs and remote access services of yours are exposed to the internet so they can be patched first.
Watch for leaked or sold company credentials, since stolen valid accounts are one of the entry routes governments describe.
Spot look-alike domains and phishing aimed at your staff and partners, since spearphishing attachments are on the group's technique list.
MITRE describes menuPass as a group active since at least 2006. The US charged two Chinese nationals, Zhu Hua and Zhang Shilong, in December 2018 over activity it links to the APT10 Group. The UK attributed the Cloud Hopper campaign to the Chinese Ministry of State Security the same day.
The UK and the EU use this name for activity against managed service providers and their clients. The EU says it targeted multinational companies on six continents and led to significant economic loss. The UK says it ran since at least 2016.
The US (indictment and CISA alert, 20 December 2018), the UK (Foreign Office and NCSC, 20 December 2018) and the EU Council (sanctions, 30 July 2020).
Governments describe access through managed service providers, stolen valid accounts, spearphishing attachments and flaws in internet-facing applications. MITRE lists each of these.
None of the government sources opened for this page reports activity after 2020. MITRE lists no campaigns for the group. Brandefense labels it dormant for that reason, which is not a claim that it has stopped.
Review the access your service providers have to your systems, turn on multi-factor authentication, secure administrator accounts and patch internet-facing applications.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.