Automation · API / MCP 中文

Group profile · G1054

MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

ATT&CK G1054 Confidence High · 100 Source src_mitre_attck_enterprise Status active
All2026

Showing 2026 citations only; facet pages stay out of the index and canonicalise to the profile.

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.123456

  1. Kaspersky LODEINFO OCT 2022
  2. Kaspersky LODEINFO Part II OCT 2022
  3. ESET MirrorFace DEC 2022
  4. JPCERT MirrorFace JUL 2024
  5. Trend Micro Earth Kasha NOV 2024
  6. Trend Micro Earth Kasha Updates APR 2025

Claims and citations

Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.

predicateobjectValidConf.Evidence
uses_techniquetech_t1566.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1686.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1614.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15912026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1685.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10162026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10072026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0082026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t12212026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1556.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10332026 → …100src_mitre_attck_enterprise

Technique use

ATT&CKTechniqueplatforms
T1003.001LSASS Memory—
T1003.002Security Account Manager—
T1003.003NTDS—
T1005Data from Local System—
T1007System Service Discovery—
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1021.001Remote Desktop Protocol—
T1021.002SMB/Windows Admin Shares—
T1027.013Encrypted/Encoded File—
T1033System Owner/User Discovery—
T1036.008Masquerade File Type—
T1047Windows Management Instrumentation—
T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol—
T1057Process Discovery—
T1059.003Windows Command Shell—
T1059.005Visual Basic—
T1070.004File Deletion—
T1071.002File Transfer Protocols—
T1074.002Remote Data Staging—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1087.002Domain Account—
T1090Proxy—
T1114.001Local Email Collection—
T1190Exploit Public-Facing Application—
T1204.002Malicious File—
T1221Template Injection—
T1482Domain Trust Discovery—
T1553.002Code Signing—
T1556.002Password Filter DLL—
T1560.001Archive via Utility—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1574.001DLL—
T1587.001Malware—
T1588.002Tool—
T1591Gather Victim Org Information—
T1614.001System Language Discovery—
T1684.001Impersonation—
T1685Disable or Modify Tools—
T1685.005Clear Windows Event Logs—
T1686.003Windows Host Firewall—

Aliases

Earth Kasha · MirrorFace

Reading and review

Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.

Corrections