UPPERCUT — Malware Profile

UPPERCUT is a 32-bit HTTP-based backdoor that has been used by menuPass since at least 2017. Once thought to be exclusive to menuPass, UPPERCUT was also observed being used by menuPass-associated MirrorFace during Operation AkaiRyū.

MITRE ATT&CK techniques (15)

• T1005 Data from Local System
• T1016 System Network Configuration Discovery
• T1033 System Owner/User Discovery
• T1059.003 Windows Command Shell
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1105 Ingress Tool Transfer
• T1113 Screen Capture
• T1124 System Time Discovery
• T1132.001 Standard Encoding
• T1548.002 Bypass User Account Control
• T1573.001 Symmetric Cryptography
• T1574.001 DLL
• T1678 Delay Execution

IntelFusions coverage

• menuPass (APT10) Deploys Cobalt Strike via Encrypted Executables and DKMC Bitmap Shellcode in Dual-Wave Attacks on Japanese Organizations 2026-02-16

Attributed threat actors

• MirrorFace
• APT10

Read the full analysis on IntelFusions