MirrorFace

Also known as:Earth Kasha

Overview

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

Naming & attribution

MirrorFace is tracked under 2 names across the industry. It uses 43 documented ATT&CK techniques — more than 78% of the 174 groups tracked here. Activity attributed since at least 2019.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Earth Kasha	Trend Micro

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1556.002 Password Filter DLL — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

menuPass China — 20 shared techniques (29% overlap)
Play — 15 shared techniques (28% overlap)
Ke3chang China — 19 shared techniques (27% overlap)
FIN8 — 17 shared techniques (27% overlap)
APT41 China — 26 shared techniques (26% overlap)
Magic Hound Iran — 24 shared techniques (25% overlap)

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190
Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 43 techniques across 12 tactics

Reconnaissance

T1591Gather Victim Org Information

Resource Development

T1587.001Malware
T1588.002Tool

Defense Impairment

Credential Access

T1003.001LSASS Memory
T1003.002Security Account Manager
T1003.003NTDS

Discovery

T1007System Service Discovery
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1087.002Domain Account
T1482Domain Trust Discovery
T1614.001System Language Discovery

Lateral Movement

T1021.001Remote Desktop Protocol
T1021.002SMB/Windows Admin Shares

Collection

Command and Control

T1071.002File Transfer Protocols
T1090Proxy

Exfiltration

T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Tools & malware (16)

Net · Cobalt Strike · MirrorStealer · UPPERCUT · Nltest · BITSAdmin · Tasklist · ipconfig · LODEINFO · ROAMINGHOUSE · DOWNIISSA · nbtstat · HiddenFace · Ping · Wevtutil · NOOPLDR

Reporting (3)

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan — Hiroaki, H
Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella — Trend Micro
MirrorFace Attack against Japanese Organisations — Tomonaga, S