LAC's threat analysis team documented in a report published on LAC WATCH two confirmed menuPass (APT10) attack waves targeting Japanese organizations in late April and early May 2018 — the first confirmed use of Cobalt Strike by this actor, previously associated exclusively with proprietary malware (ChChes, ANEL, RedLeaves/Himawari) and open-source tools including PowerSploit, Koadic, QuasarRAT, PowerShell Empire, and DKMC. Both waves delivered Cobalt Strike Beacon in-memory via distinct infection chains, with C2 traffic disguised as Wikipedia.org communications.
Wave 1: Encrypted Executable to AES-Decrypted Cobalt Strike Beacon
Spearphishing emails attached executable encrypted files that, when run, extract a double-extension malicious file (.doc.scr). Execution decrypts three XOR-encoded payloads (key: 0x36) from the .data section, writing peisnce.exe, vntfxf32.dll, and jeosa.ows to disk while displaying a decoy document. peisnce.exe loads vntfxf32.dll, which reads and AES-decrypts jeosa.ows using the hardcoded key gfjkdnropqhsjfjb — the same key used in the Himawari installer (a RedLeaves variant), providing a direct code link to menuPass's proprietary toolchain. The decrypted shellcode downloads Cobalt Strike Beacon (beacon.dll) from the C2 server via HTTP and executes it in memory. The C2 server (hosted on Romanian VPS provider HETNiX/AS3280) used a self-signed SSL certificate with "wikipedia" in the CN/OU fields, and Beacon HTTP requests spoofed the Host header as en.wikipedia.org — a deliberate attempt to cause security devices to log C2 traffic as legitimate Wikipedia access.
Wave 2: Macro-Enabled Document to DKMC Bitmap Shellcode
The second wave delivered encrypted ZIP archives containing macro-enabled documents. The macro executes a PowerShell script that downloads a VBScript downloader (Computer.vbs) from the C2 server and saves it to the Startup folder for persistence. Computer.vbs runs a further PowerShell script (Base64+gzip encoded) built with the open-source Don't Kill My Cat (DKMC) tool, which downloads cat.bmp from C2. The bitmap file passes surface-level validation (valid magic bytes 0x4d42, viewable as an image) but contains shellcode embedded in the BITMAPFILEHEADER's reserved and file-size fields — specifically encoding a JMP instruction (0xe9) targeting offset 0x3c483 within the file. Loaded into memory and executed, the shellcode ultimately deploys Cobalt Strike Beacon identically to Wave 1.
Attribution: AES Key Shared with RedLeaves Himawari Variant
The AES key gfjkdnropqhsjfjb hardcoded in the Wave 1 loader DLL was previously identified in the Himawari installer — a characteristic menuPass RedLeaves variant — providing strong code-level continuity attribution between this campaign's Cobalt Strike delivery infrastructure and menuPass's established proprietary malware suite. The broader pattern of mixing commercial penetration tools (Cobalt Strike) with open-source frameworks (DKMC, PowerSploit, Koadic) reflects menuPass's documented strategy of obscuring group identity while accelerating operational capability.