Threat Actor Characterization
menuPass
ID: 8e61b13cfeacd956a9bd72dd9d89c43d79691| APT-10 | APT10 | BR************** | C***** |
| C*** | HO***** | PO******* | Re******** |
| Re******* | St********* | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
menuPass (APT10) — China-linked espionage group behind Operation Cloud Hopper, compromising MSPs and their customers to steal IP and sensitive data via phishing, trusted-relationship abuse, valid accounts, and HTTP/HTTPS exfiltration.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1199 | Trusted Relationship | TA0001 |
|
| T1566 | Phishing | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1560.001 | Archive via Utility | TA0009 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
menuPass (aka APT10 / Stone Panda / Red Apollo / BRONZE RIVERSIDE / Cicada / HOGFISH / CVNX / POTASSIUM) is a China-linked espionage group active since at least 2006 and widely associated with the Operation Cloud Hopper campaign against managed service providers (MSPs) and their downstream customers. Public reporting and a 2018 U.S. indictment describe a years-long global theft of intellectual property and sensitive data, with operators assessed to have worked in association with the MSS Tianjin State Security Bureau. Tradecraft blends spearphishing, MSP/trusted relationship abuse, valid-account reuse, and a rotating toolset (e.g., RedLeaves, ChChes, PlugX, Poison Ivy, QuasarRAT) with RAR/WinRAR staging for exfiltration over HTTP/HTTPS C2. Capability: high for access and scale, medium for stealth; Confidence: high (ATT&CK, PwC/BAE Cloud Hopper, DOJ/FBI). Federal Bureau of Investigation
Analysts characterize menuPass as state-directed or state-supported; multiple government and private reports align on a PRC nexus and the group’s alignment with strategic economic intelligence priorities. MITRE lists extensive aliases reflecting vendor taxonomy differences.