Threat intelligence / Group

MirrorFace

[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent [MirrorFace](https://attack.mitre.org/groups/G1054) operations included targets in Central Europe and featured use of [LODEINFO](https://attack.mitre.org/software/S9020), [HiddenFace](https://attack.mitre.org/software/S9023), and [UPPERCUT](https://attack.mitre.org/software/S0275) malware.(Citation: Kaspersky LODEINFO OCT 2022)(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent [MirrorFace](https://attack.mitre.org/groups/G1054) operations included targets in Central Europe and featured use of [LODEINFO](https://attack.mitre.org/software/S9020), [HiddenFace](https://attack.mitre.org/software/S9023), and [UPPERCUT](https://attack.mitre.org/software/S0275) malware.(Citation: Kaspersky LODEINFO OCT 2022)(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

60 recorded

Relationships

attributed-to

from Operation AkaiRyū

Campaign

uses

to Archive via Utility

Technique

uses

Tool

uses

to Clear Windows Event Logs

Technique

uses

to Cobalt Strike

Malware

uses

to Code Signing

Technique

uses

to Data from Local System

Technique

uses

to Disable or Modify Tools

Technique

uses

to DLL

Technique

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

Malware

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to File Transfer Protocols

Technique

uses

to Gather Victim Org Information

Technique

uses

Malware

uses

to Impersonation

Technique

uses

Tool

uses

to Local Email Collection

Technique

uses

Malware

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

Technique

uses

to Masquerade File Type

Technique

uses

to MirrorStealer

Malware

uses

Tool

uses

to Net

Tool

uses

Tool

uses

Malware

uses

Technique

uses

to Password Filter DLL

Technique

uses

Tool

uses

to Process Discovery

Technique

uses

Technique

uses

to Remote Data Staging

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

to ROAMINGHOUSE

Malware

uses

to Security Account Manager

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Service Discovery

Technique

uses

Tool

uses

to Template Injection

Technique

uses

Technique

uses

Malware

uses

to Visual Basic

Technique

uses

Tool

uses

to Windows Command Shell

Technique

uses

to Windows Host Firewall

Technique

uses

to Windows Management Instrumentation

Technique

8 external

References

mitre-attack

G1054

Earth Kasha

—

ESET MirrorFace DEC 2022

https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/

Trend Micro Earth Kasha Updates APR 2025

https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html

Kaspersky LODEINFO OCT 2022

https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/

Kaspersky LODEINFO Part II OCT 2022

https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/

JPCERT MirrorFace JUL 2024

https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html

Trend Micro Earth Kasha NOV 2024

https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html