What tactics and techniques does menuPass use?

How menuPass gets in and stays inside

menuPass is a classic intrusion cluster that blends initial access, persistence, and lateral movement rather than relying on a single trick. The group’s value lies in chaining social engineering with follow-on intrusion tradecraft, so defenders need to think in terms of the whole intrusion path, not just the first alert.

Spearphishing and watering holes help create the first foothold by putting malicious content in front of targeted users or visiting systems. The credential theft step matters because stolen access often turns a noisy phishing event into a quieter, repeatable login path that can be reused against mail, VPN, remote access, or admin interfaces.

Once inside, malware and remote access tooling let the operator keep control, stage additional payloads, and move across systems. That usually shifts the defender’s problem from "block the lure" to "find the hands-on-keyboard activity, abnormal remote administration, and privilege misuse that follows the initial compromise."

Why credential theft and remote tooling matter to defenders

Credential theft is often the bridge between intrusion and durable access. With valid credentials, activity can look like normal user or administrator behavior, especially when the attacker uses legitimate remote tools, remote shells, or built-in admin utilities instead of obviously malicious binaries.

Watering holes are especially effective when the target population is well defined, because the attacker can concentrate on a small set of visitors and wait for the right browser, workstation, or location-based conditions. That makes web trust boundaries as important as email trust boundaries, because compromise can begin with a site the organisation already expects employees to use.

For defenders, the practical question is whether access patterns make sense for the user and system role involved. A privileged login from an unusual source, an administrative tool launched at an odd time, or multiple systems touched in a short window can be a better clue than malware name alone.

What the technique mix tells you about the campaign

When spearphishing, watering holes, credential theft, malware, and remote access tooling appear together, the campaign is usually built for repeat access and operational flexibility. That combination supports both opportunistic collection of credentials and deliberate post-compromise control, which is why simple inbox filtering or signature-based detection will not fully address the threat.

The mix also suggests that lateral movement is part of the intended workflow, not an incidental side effect. If one foothold is lost, the operator may already have alternate access paths or enough internal visibility to pivot to another machine, account, or administrative channel.

For this reason, defenders should treat administrator activity, account reuse, and unusual internal remote administration as first-class detection targets. Those signals often reveal the operational phase where the group is trying to translate initial access into sustained access and broader reach.

Risk and Threat Considerations

These tactics are dangerous because they target both people and trust paths. A successful lure can expose credentials, enable remote control, and let the operator blend in with legitimate administration, which raises the likelihood of persistence and lateral spread before the compromise is noticed.

Failure mechanism: The attacker gains an initial foothold through phishing or a watering hole, captures credentials or deploys malware, then uses valid access and remote tooling to look like normal internal activity while moving laterally.

Impact: Organisations can lose visibility into who is acting, which systems are being touched, and whether administrative access is legitimate, increasing the chance of prolonged compromise, data access, and follow-on disruption.

Practitioner Guidance

What to verify: Correlate email ingress, browser-originated access, privileged logins, and administrator tool execution on the same timeline. A single suspicious event is less useful than a sequence that shows lure, access, and internal movement.

Decision rule: If a login is valid but anomalous, treat it as a potential compromise candidate rather than a clean authentication success. Valid credentials do not mean valid intent, especially when the session is followed by remote tool use or broad internal probing.

Practitioner takeaway: For menuPass-style activity, the key question is not whether the initial exploit was blocked, but whether the environment can quickly distinguish legitimate administration from attacker use of the same tools and identities.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?