Home / Threat actors / MirrorFace

MirrorFace G1054

🔔 Create alert

Also known as: Earth Kasha

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0

associated CVEs

46

Techniques

16

Malware and tools

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Reconnaissance

T1591 Gather Victim Org Information

Resource Development

T1587.001 Malware T1588.002 Tool

Initial Access

T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1059.003 Windows Command Shell T1059.005 Visual Basic T1204.002 Malicious File T1574.001 DLL

Persistence

T1556.002 Password Filter DLL

Stealth

T1027.013 Encrypted/Encoded File T1036.008 Masquerade File Type T1070.004 File Deletion T1221 Template Injection T1574.001 DLL T1684.001 Impersonation

Defense Impairment

T1553.002 Code Signing T1556.002 Password Filter DLL T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs T1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1556.002 Password Filter DLL

Discovery

T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1482 Domain Trust Discovery T1614.001 System Language Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares

Collection

T1005 Data from Local System T1074.002 Remote Data Staging T1114.001 Local Email Collection T1560.001 Archive via Utility

Command and Control

T1071.002 File Transfer Protocols T1090 Proxy

Exfiltration

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Malware and tools

Cobalt StrikeMalwareS0154
DOWNIISSAMalwareS9021
HiddenFaceMalwareS9023
LODEINFOMalwareS9020
MirrorStealerMalwareS9022
NOOPLDRMalwareS9025
ROAMINGHOUSEMalwareS9026
UPPERCUTMalwareS0275
BITSAdminToolS0190
ipconfigToolS0100
nbtstatToolS0102
NetToolS0039
NltestToolS0359
PingToolS0097
TasklistToolS0057
WevtutilToolS0645

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.