自动化接入 · API / MCP EN

组织档案 · G1054

MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

ATT&CK G1054 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2026

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.123456

  1. Kaspersky LODEINFO OCT 2022
  2. Kaspersky LODEINFO Part II OCT 2022
  3. ESET MirrorFace DEC 2022
  4. JPCERT MirrorFace JUL 2024
  5. Trend Micro Earth Kasha NOV 2024
  6. Trend Micro Earth Kasha Updates APR 2025

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asMirrorFace— → …100src_mitre_attck_enterprise
also_known_asEarth Kasha— → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10572026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1686.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1074.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t16852026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1087.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1614.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t15912026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1685.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1587.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1070.0042026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10832026 → …100src_mitre_attck_enterprise
uses_techniquetech_t14822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1684.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1588.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1204.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10182026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10162026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1553.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1566.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1059.0052026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10072026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10822026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1048.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1574.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1021.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1071.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t11902026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1036.0082026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1003.0032026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1560.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t12212026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1556.0022026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10472026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1114.0012026 → …100src_mitre_attck_enterprise
uses_techniquetech_t1027.0132026 → …100src_mitre_attck_enterprise
uses_techniquetech_t10332026 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1003.001LSASS Memory—
T1003.002Security Account Manager—
T1003.003NTDS—
T1005Data from Local System—
T1007System Service Discovery—
T1016System Network Configuration Discovery—
T1018Remote System Discovery—
T1021.001Remote Desktop Protocol—
T1021.002SMB/Windows Admin Shares—
T1027.013Encrypted/Encoded File—
T1033System Owner/User Discovery—
T1036.008Masquerade File Type—
T1047Windows Management Instrumentation—
T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol—
T1057Process Discovery—
T1059.003Windows Command Shell—
T1059.005Visual Basic—
T1070.004File Deletion—
T1071.002File Transfer Protocols—
T1074.002Remote Data Staging—
T1082System Information Discovery—
T1083File and Directory Discovery—
T1087.002Domain Account—
T1090Proxy—
T1114.001Local Email Collection—
T1190Exploit Public-Facing Application—
T1204.002Malicious File—
T1221Template Injection—
T1482Domain Trust Discovery—
T1553.002Code Signing—
T1556.002Password Filter DLL—
T1560.001Archive via Utility—
T1566.001Spearphishing Attachment—
T1566.002Spearphishing Link—
T1574.001DLL—
T1587.001Malware—
T1588.002Tool—
T1591Gather Victim Org Information—
T1614.001System Language Discovery—
T1684.001Impersonation—
T1685Disable or Modify Tools—
T1685.005Clear Windows Event Logs—
T1686.003Windows Host Firewall—

别名

Earth Kasha · MirrorFace

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错