menu Pass Returns with New Malware and New Attacks Against Japanese Academics and Organizations
Summary: From September through November 2016, the APT campaign menuPass targeted Japanese academics in several areas of science, a Japanese pharmaceutical organization, and a US-based subsidiary of a Japanese manufacturer, using the known PlugX and Poison Ivy tools plus a new Trojan that JPCERT named ChChes. The ChChes samples were digitally signed with a certificate originally used by HackingTeam that expired on August 4, 2012 and was revoked on July 10, 2015, and the spear-phishing emails spoofed sender addresses including public addresses associated with the Sasakawa Peace Foundation and The White House.
Why it matters: menuPass has targeted Japanese organizations since at least 2014 and hit the same organizations and academics largely each month in this campaign, and ChChes carries no persistence of its own, suggesting it is a first-stage tool meant to orient attackers inside a network before additional malware is deployed.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026