MirrorFace (G1054) | Threat Actor Index

43

Techniques

16

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

View MITRE record ↗

Techniques by Tactic (43)

Reconnaissance

T1591 Gather Victim Org Information

Resource Development

T1587.001 MalwareT1588.002 Tool

Initial Access

T1190 Exploit Public-Facing ApplicationT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1047 Windows Management InstrumentationT1059.003 Windows Command ShellT1059.005 Visual BasicT1204.002 Malicious FileT1574.001 DLL

Persistence

T1556.002 Password Filter DLL

Stealth

T1027.013 Encrypted/Encoded FileT1036.008 Masquerade File TypeT1070.004 File DeletionT1221 Template InjectionT1574.001 DLLT1684.001 Impersonation

Defence Impairment

T1553.002 Code SigningT1556.002 Password Filter DLLT1685 Disable or Modify ToolsT1685.005 Clear Windows Event LogsT1686.003 Windows Host Firewall

Credential Access

T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1556.002 Password Filter DLL

Discovery

T1007 System Service DiscoveryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.002 Domain AccountT1482 Domain Trust DiscoveryT1614.001 System Language Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin Shares

Collection

T1005 Data from Local SystemT1074.002 Remote Data StagingT1114.001 Local Email CollectionT1560.001 Archive via Utility

Command & Control

T1071.002 File Transfer ProtocolsT1090 Proxy

Exfiltration

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Toolsets (16)

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

DOWNIISSA S9021

Malware · Windows

🐛

HiddenFace S9023

Malware · Windows

🐛

LODEINFO S9020

Malware · Windows

🐛

MirrorStealer S9022

Malware · Windows

🐛

NOOPLDR S9025

Malware · Windows

🐛

ROAMINGHOUSE S9026

Malware · Windows

🐛

UPPERCUT S0275

Malware · Windows

🔧

BITSAdmin S0190

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

Nltest S0359

Tool · Windows

🔧

Ping S0097

Tool

🔧

Tasklist S0057

Tool

🔧

Wevtutil S0645

Tool · Windows

🔧

ipconfig S0100

Tool

🔧

nbtstat S0102

Tool

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (6)

↑