Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0045
MITRE ATT&CK Group

menuPass (G0045)

CicadaPOTASSIUMStone PandaAPT10Red ApolloCVNXHOGFISHBRONZE RIVERSIDE
ShareXLinkedInRedditHN

[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://attack.mitre.org/groups/G0045) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) [menuPass](https://attack.mitre.org/groups/G0045) has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.(Citation: Palo Alto menuPass Feb 2017)(Citation: Crowdstrike CrowdCast Oct 2013)(Citation: FireEye Poison Ivy)(Citation: PWC Cloud Hopper April 2017)(Citation: FireEye APT10 April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

▪Techniques used (46)

T1018Remote System DiscoveryT1047Windows Management InstrumentationT1036Masquerading

▪Software used (25)

S0160certutiltoolS0628FYAntimalware
G0045 on MITRE ATT&CK →
T1070.004File Deletion
T1046Network Service Discovery
T1049System Network Connections Discovery
T1560.001Archive via Utility
T1566.001Spearphishing Attachment
T1105Ingress Tool Transfer
T1588.002Tool
T1204.002Malicious File
T1090.002External Proxy
T1078Valid Accounts
T1016System Network Configuration Discovery
T1568.001Fast Flux DNS
T1036.003Rename Legitimate Utilities
T1056.001Keylogging
T1087.002Domain Account
T1003.003NTDS
T1218.004InstallUtil
T1106Native API
T1003.002Security Account Manager
T1027.013Encrypted/Encoded File
T1199Trusted Relationship
T1190Exploit Public-Facing Application
T1074.002Remote Data Staging
T1070.003Clear Command History
T1140Deobfuscate/Decode Files or Information
T1553.002Code Signing
T1053.005Scheduled Task
T1055.012Process Hollowing
T1074.001Local Data Staging
T1021.001Remote Desktop Protocol
T1039Data from Network Shared Drive
T1003.004LSA Secrets
T1083File and Directory Discovery
T1036.005Match Legitimate Resource Name or Location
T1560Archive Collected Data
T1059.003Windows Command Shell
T1005Data from Local System
T1059.001PowerShell
T1210Exploitation of Remote Services
T1021.004SSH
T1119Automated Collection
T1583.001Domains
T1574.001DLL
S0275UPPERCUTmalware
S0159SNUGRIDEmalware
S0626P8RATmalware
S0153RedLeavesmalware
S0627SodaMastermalware
S0006pwdumptool
S0002Mimikatztool
S0013PlugXmalware
S0039Nettool
S0194PowerSploittool
S0144ChChesmalware
S0106cmdtool
S0262QuasarRATtool
S0552AdFindtool
S0154Cobalt Strikemalware
S0012PoisonIvymalware
S0152EvilGrabmalware
S0404esentutltool
S0357Impackettool
S0624Ecipekacmalware
S0097Pingtool
S0029PsExectool
S1097HUI Loadermalware

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.