Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

menu Pass Playbook and IOCs

Summary: On December 20, 2018, the US Department of Justice indicted two Chinese nationals on charges of computer hacking, conspiracy to commit wire fraud, and aggravated identity theft, alleging they were members of menuPass (also tracked as APT10) acting at the behest of China's Ministry of State Security. The charges stem from Operation Cloud Hopper, a campaign beginning in 2014 that largely targeted Managed Service Providers to steal MSP and client intellectual property and to leverage their networks for further attacks, with victims worldwide in banking, healthcare, government, aerospace, defense, telecommunications, and consumer electronics. Unit 42 released its full set of menuPass IOCs and a playbook based on late-2016 activity, and noted that shared malware families EvilGrab, PlugX, Poison Ivy, and QuasarRAT indicate a possible intrusion but are not necessarily tied to menuPass.

Bottom line: The group's entry point was the service provider, not the target - a single compromised MSP gave menuPass reach into client networks across banking, healthcare, government, and defense, and the group has been active since roughly 2006 with a marked interest in Japan since 2014.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related