H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ROAMINGHOUSE](https://attack.mitre.org/software/S9026) is a dropper malware used by [MirrorFace](https://attack.mitre.org/groups/G1054) to extract and execute embedded payloads including [UPPERCUT](https://attack.mitre.org/software/S0275) components.(Citation: Trend Micro Earth Kasha Updates APR 2025)

Labels

malware

13 recorded

Relationships

uses

from MirrorFace

Group

uses

from Operation AkaiRyū

Campaign

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Office Template Macros

Technique

uses

to Security Software Discovery

Technique

uses

to Spearphishing Link

Technique

uses

to User Activity Based Checks

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

S9026

Trend Micro Earth Kasha Updates APR 2025

https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html