MITRE ATT&CKgroup

G1054 MirrorFace

Published 2026-04-17 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Earth Kasha
Version
1.0
Created
2026-04-17

Description

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

Related

Uses · MITRE ATT&CK (59)

  • S9020 LODEINFO software (malware)
  • S9021 DOWNIISSA software (malware)
  • S9022 MirrorStealer software (malware)
  • S9023 HiddenFace software (malware)
  • S9025 NOOPLDR software (malware)
  • S9026 ROAMINGHOUSE software (malware)
  • T1684.001 Impersonation sub-technique
  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1686.003 Windows Host Firewall sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1036.008 Masquerade File Type sub-technique
  • S0645 Wevtutil software (tool)
  • T1614.001 System Language Discovery sub-technique
  • T1591 Gather Victim Org Information technique
  • T1587.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1071.002 File Transfer Protocols sub-technique
  • T1074.002 Remote Data Staging sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1087.002 Domain Account sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1114.001 Local Email Collection sub-technique
  • T1003.001 LSASS Memory sub-technique
Show all 59 ›

Referenced by MITRE ATT&CK · attributed to (1)

  • C0060 Operation AkaiRyū campaign

References