Cyber threats / Threat actors

MirrorFace

CN Suspected sponsor: China · ATT&CK G1054
0
APAC targets
43
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: Earth Kasha

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

Related profiles: APT10

Profiles whose description names this actor, that this description names, or that share one of its names. The sources mention them together; they are not necessarily the same group.

ATT&CK techniques · 43
Reconnaissance
Resource Development
Initial Access
Execution
Persistence
Stealth
Defense Impairment
Credential Access
Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References
Sources: MISP, MITRE