MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.123456
- Kaspersky LODEINFO OCT 2022
- Kaspersky LODEINFO Part II OCT 2022
- ESET MirrorFace DEC 2022
- JPCERT MirrorFace JUL 2024
- Trend Micro Earth Kasha NOV 2024
- Trend Micro Earth Kasha Updates APR 2025
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | MirrorFace | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Earth Kasha | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1684.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1007 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.008 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.002 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.001 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2026 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2026 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1007 | System Service Discovery | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1033 | System Owner/User Discovery | — |
| T1036.008 | Masquerade File Type | — |
| T1047 | Windows Management Instrumentation | — |
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | — |
| T1057 | Process Discovery | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1070.004 | File Deletion | — |
| T1071.002 | File Transfer Protocols | — |
| T1074.002 | Remote Data Staging | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.002 | Domain Account | — |
| T1090 | Proxy | — |
| T1114.001 | Local Email Collection | — |
| T1190 | Exploit Public-Facing Application | — |
| T1204.002 | Malicious File | — |
| T1221 | Template Injection | — |
| T1482 | Domain Trust Discovery | — |
| T1553.002 | Code Signing | — |
| T1556.002 | Password Filter DLL | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1574.001 | DLL | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1591 | Gather Victim Org Information | — |
| T1614.001 | System Language Discovery | — |
| T1684.001 | Impersonation | — |
| T1685 | Disable or Modify Tools | — |
| T1685.005 | Clear Windows Event Logs | — |
| T1686.003 | Windows Host Firewall | — |
Aliases
Earth Kasha · MirrorFace
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.