Threat actor · G1054

MirrorFace

Earth Kasha

UnattributedNo public state or group attribution on record

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors.

MITRE ATT&CK Techniques

Associated Malware

BITSAdminCobalt StrikeDOWNIISSAHiddenFaceLODEINFOMirrorStealerNOOPLDRNetNltestPingROAMINGHOUSETasklistUPPERCUTWevtutilipconfignbtstat

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.