District Court of NY APT10 Indictment December 2018

menuPass has used RDP connections to move across the victim network.

menuPass has been seen changing malicious files to appear legitimate.

menuPass has used key loggers to steal usernames and passwords.

A menuPass macro deletes files after it has decoded and decompressed them.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

menuPass has installed updates and new malware on victims.

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

menuPass has encrypted files and information before exfiltration.

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

menuPass has used dynamic DNS service providers to host malicious domains.

menuPass has registered malicious domains for use in intrusion campaigns.