APT GroupHigh for the historical APT10/menuPass identity and cited campaign behaviors; attribution of any current SOGU/PlugX incident requires case-specific evidence because the malware family is used by multiple operators. confidenceSynced actor recordProfile updated 2026-08-06T16:00:00.000Z

menuPass

Historical public reporting connects APT10/menuPass to credential theft, managed-service-provider and downstream-client access, DLL side-loading, PlugX-family tooling, and Japan-linked espionage. These actor links provide context but do not attribute every SOGU or PlugX-family intrusion.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type¹

Not identified as a standalone RaaS brand in this seed row.

First Seen¹

2017-05-31

Last Seen¹

ATT&CK record modified 2026-05-12; operational last-seen varies by source

Profile Updated¹

2026-08-06T16:00:00.000Z

Victim Count

Not available

Origin¹

Unknown

Motivation¹

Espionage / strategic intelligence collection

Primary Access Pattern¹

T1078 Valid Accounts

Objective¹

Espionage / strategic intelligence collection

Identity

Aliases And Boundaries

Aliases¹

APT10menuPassCicadaCloud HopperRed ApolloPOTASSIUMStone PandaCVNXHOGFISHBRONZE RIVERSIDE

Source Boundary

Retained source record is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure

Not available

Target Sectors

Managed Service ProvidersTechnologyGovernmentHealthcareEnergyCommunicationsManufacturingProfessional ServicesJapan-linked organizationsDefenseFinancial ServicesEducationCloud / SaaS

Associated Activity¹

Stolen privileged credentials or certificatesUnexpected managed-service-provider to client accessLegitimate executable plus unexpected adjacent DLL and encoded payloadMemory-resident PlugX/SOGU evidenceUnexpected scheduled-task or Windows-service persistencePrivileged VPN, RDP, SMB, or admin-share activity inconsistent with baselineUnexpected RMM sessions, new remote-management agents, unusual admin console logins, and lateral movement from management hosts.Long-tail credential use, stealthy persistence, living-off-the-land execution, targeted collection, and encrypted outbound C2.Telemetry aligned to T1018 Remote System Discovery.Telemetry aligned to T1047 Windows Management Instrumentation.Telemetry aligned to T1036 Masquerading.

ATT&CK IDs¹

T1078 Valid AccountsT1199 Trusted RelationshipT1574.001 DLL Search Order HijackingT1620 Reflective Code LoadingT1021 Remote ServicesT1003 OS Credential DumpingT1053.005 Scheduled Task/Job: Scheduled TaskT1543.003 Create or Modify System Process: Windows ServiceT1018 Remote System Discovery (discovery)T1047 Windows Management Instrumentation (execution)T1036 Masquerading (stealth)T1070.004 File Deletion (stealth)T1046 Network Service Discovery (discovery)T1049 System Network Connections Discovery (discovery)T1560.001 Archive via Utility (collection)T1566.001 Spearphishing Attachment (initial access)T1105 Ingress Tool Transfer (command and control)T1588.002 Tool (resource development)T1204.002 Malicious File (execution)T1090.002 External Proxy (command and control)

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported Not availableIntelliOS retained 0

No public IOC values are currently retained in IntelliOS for this profile. Future enrichment can add cited observables from SOCRadar, Microsoft threat intelligence, Google/Mandiant, CrowdStrike, MITRE CTI, CISA, vendor reports, and other reliable open sources.

Source coverage: 2 source groups tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables

Source	Reported	Retained	Coverage Status
SOCRadar	N/A	0	Profile retained; no SOCRadar IOC count currently stored.
MITRE ATT&CK / CTI¹	N/A	0	Technique and identity context retained; not treated as raw IOC feed for this card.

IntelliOS Intel Products

Linked Products

PANDA Flash Threat Intel Brief

SOGU Flash Threat Brief

Source-backed investigation and response brief for credential- and provider-trust-led access, DLL side-loading, memory collection, and proof criteria.

CARDS Campaign

PLUGX/SOGU Multi-Victim Intrusions

Campaign record with explicit attribution and CVE relationship boundaries.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
Retained source record	menuPass	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	menuPass	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	MITRE ATT&CK https://attack.mitre.org/groups/G0045/	Canonical ATT&CK group, campaign, software, aliases, and technique mapping source where matched.
2	SOGU Flash Threat Brief /vault/sogu-plugx-remote-access-malware	IntelliOS Flash Threat Brief
3	PLUGX/SOGU Multi-Victim Intrusions /threat-actor-cards/campaigns/plugx-sogu-multi-victim-intrusions	CARDS Campaign
4	CISA multi-victim intrusion alert https://www.cisa.gov/sites/default/files/publications/IR-ALERT-MED-17-093-01C-Intrusions_Affecting_Multiple_Victims_Across_Multiple_Sectors.pdf	Government Alert
5	DOJ: APT10 global intrusion campaigns https://www.justice.gov/usao-sdny/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer	Government Attribution
6	Symantec: Cicada/APT10 Japan-linked campaign https://www.security.com/threat-intelligence/cicada-apt10-japan-espionage	Primary Campaign Research
7	Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018. http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf	Accenture Hogfish April 2018
8	Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS... https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader	SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
9	Crowdstrike. (2013, October 16). CrowdCasts Monthly: You Have an Adversary Problem.... https://www.slideshare.net/slideshow/crowd-casts-monthly-you-have-an-adversary-problem/27262315	Crowdstrike CrowdCast Oct 2013
10	FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global... https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html	FireEye APT10 April 2017
11	FireEye. (2014). POISON IVY: Assessing Damage and Extracting Intelligence. Retrieved... https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf	FireEye Poison Ivy
12	Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using... https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html	FireEye APT10 Sept 2018

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for menuPass.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards