menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.(Citation: PWC Cloud Hopper April 2017)(Citation: Symantec Cicada November 2020)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

menuPass uses

PowerSploit to inject shellcode into PowerShell.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

menuPass has used tcping.exe, similar to

Ping, to probe port status on systems of interest.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.(Citation: PWC Cloud Hopper April 2017)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

menuPass has collected data from remote systems by mounting network shares with

menuPass uses scripts to enumerate IP ranges on the victim network.

menuPass has also issued the command

PlugX implant to gather information about remote systems on the network.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|