MirrorFace

Also known as Earth Kasha

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1005 Data from Local System T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1036.008 Masquerade File Type T1047 Windows Management Instrumentation T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1057 Process Discovery T1059.003 Windows Command Shell T1059.005 Visual Basic T1070.004 File Deletion T1071.002 File Transfer Protocols T1074.002 Remote Data Staging T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1090 Proxy T1114.001 Local Email Collection T1190 Exploit Public-Facing Application T1204.002 Malicious File T1221 Template Injection T1482 Domain Trust Discovery T1553.002 Code Signing T1556.002 Password Filter DLL T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1574.001 DLL T1587.001 Malware T1588.002 Tool T1591 Gather Victim Org Information T1614.001 System Language Discovery T1684.001 Impersonation T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs T1686.003 Windows Host Firewall

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.