Início / Grupos de ameaça / MirrorFace

MirrorFace G1054

🔔 Criar alerta

Também conhecido como: Earth Kasha

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

0

CVEs associadas

46

Técnicas

16

Malwares e ferramentas

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

O ATT&CK não cita CVEs para este grupo.

Técnicas por tática

Reconhecimento

T1591 Gather Victim Org Information

Desenvolvimento de recursos

T1587.001 Malware T1588.002 Tool

Acesso inicial

T1190 Exploit Public-Facing Application T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1059.003 Windows Command Shell T1059.005 Visual Basic T1204.002 Malicious File T1574.001 DLL

Persistência

T1556.002 Password Filter DLL

Furtividade

T1027.013 Encrypted/Encoded File T1036.008 Masquerade File Type T1070.004 File Deletion T1221 Template Injection T1574.001 DLL T1684.001 Impersonation

Comprometimento de defesas

T1553.002 Code Signing T1556.002 Password Filter DLL T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs T1686.003 Windows Host Firewall

Acesso a credenciais

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1556.002 Password Filter DLL

Descoberta

T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1057 Process Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1482 Domain Trust Discovery T1614.001 System Language Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares

Coleta

T1005 Data from Local System T1074.002 Remote Data Staging T1114.001 Local Email Collection T1560.001 Archive via Utility

Comando e controle

T1071.002 File Transfer Protocols T1090 Proxy

Exfiltração

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Malwares e ferramentas

Cobalt StrikeMalwareS0154
DOWNIISSAMalwareS9021
HiddenFaceMalwareS9023
LODEINFOMalwareS9020
MirrorStealerMalwareS9022
NOOPLDRMalwareS9025
ROAMINGHOUSEMalwareS9026
UPPERCUTMalwareS0275
BITSAdminFerramentaS0190
ipconfigFerramentaS0100
nbtstatFerramentaS0102
NetFerramentaS0039
NltestFerramentaS0359
PingFerramentaS0097
TasklistFerramentaS0057
WevtutilFerramentaS0645

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.