PWC Cloud Hopper April 2017

menuPass has used RDP connections to move across the victim network.

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.

menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.

menuPass has used net use to conduct connectivity checks to machines.

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

menuPass has installed updates and new malware on victims.

menuPass has compressed files before exfiltration using TAR and RAR.

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.