Symantec Cicada November 2020

menuPass has used Ntdsutil to dump credentials.

menuPass has collected various files from the compromised computers.

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

menuPass uses PowerSploit to inject shellcode into PowerShell.

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.

menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.

menuPass has used the Csvde tool to collect Active Directory files and data.

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).

menuPass has compressed files before exfiltration using TAR and RAR.

menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.