MirrorFace
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.
- ATT&CK ID
- G1054
- Origin
- China
- Techniques
- 37
- Tools
- 16
Also tracked as Earth Kasha
Techniques
Reconnaissance
Resource Development
Develop CapabilitiesObtain Capabilities
Initial Access
Exploit Public-Facing ApplicationPhishing
Execution
Windows Management InstrumentationCommand and Scripting InterpreterUser ExecutionHijack Execution Flow
Persistence
Stealth
Obfuscated Files or InformationMasqueradingIndicator RemovalTemplate InjectionHijack Execution FlowSocial Engineering
Defense Impairment
Subvert Trust ControlsModify Authentication ProcessDisable or Modify ToolsDisable or Modify System Firewall
Credential Access
OS Credential DumpingModify Authentication Process
Discovery
System Service DiscoverySystem Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoveryDomain Trust DiscoverySystem Location Discovery
Lateral Movement
Collection
Data from Local SystemData StagedEmail CollectionArchive Collected Data
Command and Control
Application Layer ProtocolProxy
Exfiltration
Exfiltration Over Alternative Protocol
Software
BITSAdmin · Cobalt Strike · DOWNIISSA · HiddenFace · LODEINFO · MirrorStealer · NOOPLDR · Net · Nltest · Ping · ROAMINGHOUSE · Tasklist · UPPERCUT · Wevtutil · ipconfig · nbtstat