{"id":56413,"date":"2024-06-26T00:00:00","date_gmt":"2024-06-26T00:00:00","guid":{"rendered":"urn:uuid:3f5c7507-1cec-1979-dc33-eed62e9160b0"},"modified":"2024-06-26T00:00:00","modified_gmt":"2024-06-26T00:00:00","slug":"attackers-in-profile-menupass-and-alphv-blackcat","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/","title":{"rendered":"Attackers in Profile: menuPass and ALPHV\/BlackCat"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/menupass-alphv-blackcat-threats:Large?qlt=80\"><\/p>\n<div><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/24\/menupass-alphv-blackcat-threats.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>The structural complexities of menuPass\/APT10 Umbrella points to one of the basic challenges of threat intelligence: threat actors are not always tidily defined or homogenous.<\/p>\n<p>ALPHV\/BlackCat brings its own wrinkles to the puzzle. Sometimes it is regarded as a Rust-based ransomware available as a service and sometimes it\u2019s referred to as the threat actor group responsible for producing and overseeing that as-as-service offering.<\/p>\n<p>MITRE Engenuity clearly puts ALPHV\/BlackCat <a href=\"https:\/\/medium.com\/mitre-engenuity\/att-ck-evaluations-managed-services-2024-actionable-insights-and-the-challenge-of-dual-93fd8506d271\" target=\"_blank\" rel=\"noopener\">in that latter bucket<\/a>, explaining, \u201cA ransomware-as-a-service operation, ALPHV\/BlackCat emerged in 2021, targeting various industries with a flexible ransomware strain capable of cross-platform attacks on Windows, Linux, and VMware systems.\u201d<\/p>\n<p>MITRE Engenuity borrowed \u201csignature behaviors\u201d from both menuPass and ALPHV\/BlackCat to mount a \u201cmulti-subsidiary compromise with overlapping operations focusing on defense evasion, exploiting trusted relationships, data encryption, and inhibiting system recovery.\u201d<\/p>\n<p>From menuPass, the evaluation took a mix of living-off-the-land techniques, custom, fileless malware, anti-analysis tactics, and exploitation of trusted third-party relationships for credential access. It copied ALPHV\/BlackCat defense evasion techniques as well, along with data exfiltration, data encryption, data destruction, and system recovery obstruction.<\/p>\n<p><span class=\"body-subhead-title\">Where are they now?<\/span><\/p>\n<p>While the TTPs used for the MITRE Engenuity managed service evaluation are well known and documented, threat actors don\u2019t stay frozen in time. Trend\u2122 Research is continuing to track both menuPass and ALPHV\/BlackCat.<\/p>\n<p>As a state-sponsored cyber espionage group, menuPass (APT10 Umbrella) is constantly shifting targets based on whatever nation state is paying them. Its goals are generally the same: brokerage of information, and theft of personally identifying information and related activities. In 2018 it was reported that <a href=\"https:\/\/www.justice.gov\/opa\/pr\/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion\" target=\"_blank\" rel=\"noopener\">members of the group had been indicted<\/a>, but the group itself has since resurfaced, creating a splash during the pandemic with apparent (unsuccessful) intrusions against Indian vaccine makers and then playing a role in the <a href=\"https:\/\/securelist.com\/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign\/101519\/\" target=\"_blank\" rel=\"noopener\">A41APT<\/a> multi-industry data theft campaign.<\/p>\n<p>Because menuPass has so many subgroups and splinters, it\u2019s imprecise to attribute any specific campaign to the umbrella entity, or to consider any single motive, toolset, or TTP to be definitively identifying.<\/p>\n<p>The ALPHV\/BlackCat group that \u2018inspired\u2019 the MITRE Engenuity attack approach for this year\u2019s managed services evaluation is defunct, <a href=\"https:\/\/krebsonsecurity.com\/2024\/03\/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare\/\" target=\"_blank\" rel=\"noopener\">splitting up in an internal fight<\/a> over the ransom paid by Change Healthcare in winter 2024. Even so, ransomware threat actor groups have a tendency to burn out, reform, and resurface since ransomware is a lucrative business.<\/p>\n<p>In general, threat actors\u2019 TTPs are becoming increasingly similar in response to cybercrime \u2018best practices\u2019 and evolving security techniques.<\/p>\n<p><span class=\"body-subhead-title\">Threat intelligence is critical<\/span><\/p>\n<p>Defending against actors like menuPass and ALPHV\/BlackCat requires a combination of advanced cybersecurity tools and leading threat intelligence. The importance of the second part of that formula can\u2019t be understated. Knowing where a threat is coming from, what\u2019s likely motivating it, and what the attackers\u2019 next moves may be can all aid better, more effective decisions for tracking and mitigating threats.<\/p>\n<p>Trend Micro\u2122 Managed Detection and Response (MDR) service is built on our Trend Vision One\u2122 platform and informed by Trend Research threat intelligence and the findings of our Trend Micro\u2122 Zero-Day Initiative\u2122 (ZDI). Trend Vision One provides the automated detection and response capabilities, while the understanding of threat behaviors and how to handle them comes from Trend Research.<\/p>\n<p>Beyond advanced persistent threats and ransomware, other major focuses of Trend Research today include securing AI, cloud, and network threats and understanding the risk landscape overall\u2014what it\u2019s made of and how it\u2019s changing. We\u2019re committed to continuing our work to bring insight to cybersecurity to provide the most effective managed security services possible and drive the advancement of security technologies.<\/p>\n<p><span class=\"body-subhead-title\">Next steps<\/span><\/p>\n<p>For more on our Trend MDR, XDR, and other related topics, check out these additional resources:<\/p>\n<p> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/f\/menupass-alphv-blackcat-threats.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>To test the effectiveness of managed services like our Trend Micro managed detection and response offering, MITRE Engenuity\u2122 combined the tools, techniques, and practices of two globally notorious bad actors: menuPass and ALPHV\/BlackCat. This blog tells the story of why they were chosen and what makes them threats to be reckoned with. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":56414,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9521,9511,9555,9534],"class_list":["post-56413","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cyber-crime","tag-trend-micro-research-cyber-threats","tag-trend-micro-research-exploitsvulnerabilities","tag-trend-micro-research-latest-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Attackers in Profile: menuPass and ALPHV\/BlackCat 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Attackers in Profile: menuPass and ALPHV\/BlackCat 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-26T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/menupass-alphv-blackcat-threats:Large?qlt=80\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Attackers in Profile: menuPass and ALPHV\\\/BlackCat\",\"datePublished\":\"2024-06-26T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/\"},\"wordCount\":629,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/attackers-in-profile-menupass-and-alphv-blackcat.jpg\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cyber Crime\",\"Trend Micro Research : Cyber Threats\",\"Trend Micro Research : Exploits&amp;Vulnerabilities\",\"Trend Micro Research : Latest News\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/\",\"name\":\"Attackers in Profile: menuPass and ALPHV\\\/BlackCat 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/attackers-in-profile-menupass-and-alphv-blackcat.jpg\",\"datePublished\":\"2024-06-26T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/attackers-in-profile-menupass-and-alphv-blackcat.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/06\\\/attackers-in-profile-menupass-and-alphv-blackcat.jpg\",\"width\":977,\"height\":535},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/attackers-in-profile-menupass-and-alphv-blackcat\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Attackers in Profile: menuPass and ALPHV\\\/BlackCat\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Attackers in Profile: menuPass and ALPHV\/BlackCat 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/","og_locale":"en_US","og_type":"article","og_title":"Attackers in Profile: menuPass and ALPHV\/BlackCat 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-06-26T00:00:00+00:00","og_image":[{"url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/menupass-alphv-blackcat-threats:Large?qlt=80","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Attackers in Profile: menuPass and ALPHV\/BlackCat","datePublished":"2024-06-26T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/"},"wordCount":629,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/06\/attackers-in-profile-menupass-and-alphv-blackcat.jpg","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cyber Crime","Trend Micro Research : Cyber Threats","Trend Micro Research : Exploits&amp;Vulnerabilities","Trend Micro Research : Latest News"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/","url":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/","name":"Attackers in Profile: menuPass and ALPHV\/BlackCat 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/06\/attackers-in-profile-menupass-and-alphv-blackcat.jpg","datePublished":"2024-06-26T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/06\/attackers-in-profile-menupass-and-alphv-blackcat.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2024\/06\/attackers-in-profile-menupass-and-alphv-blackcat.jpg","width":977,"height":535},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/attackers-in-profile-menupass-and-alphv-blackcat\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Attackers in Profile: menuPass and ALPHV\/BlackCat"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56413","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56413"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56413\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/56414"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56413"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56413"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56413"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}