Threat intelligence / Malware

HiddenFace

[HiddenFace](https://attack.mitre.org/software/S9023) is a modular backdoor developed and used exclusively by [MirrorFace](https://attack.mitre.org/groups/G1054) since at least 2021. [HiddenFace](https://attack.mitre.org/software/S9023) can communicate both actively and passively and has been used against political and academic targets.(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[HiddenFace](https://attack.mitre.org/software/S9023) is a modular backdoor developed and used exclusively by [MirrorFace](https://attack.mitre.org/groups/G1054) since at least 2021. [HiddenFace](https://attack.mitre.org/software/S9023) can communicate both actively and passively and has been used against political and academic targets.(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

Labels

malware

27 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Dynamic API Resolution

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Execution Guardrails

Technique

uses

to Fallback Channels

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Internal Proxy

Technique

uses

to Modify Registry

Technique

uses

to Mutual Exclusion

Technique

uses

to Non-Application Layer Protocol

Technique

uses

to Non-Standard Port

Technique

uses

to Process Discovery

Technique

uses

to Process Injection

Technique

uses

to Protocol Tunneling

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Time Based Checks

Technique

uses

Technique

uses

to Windows Host Firewall

Technique

uses

from MirrorFace

Group

uses

from Operation AkaiRyū

Campaign

6 external

References

mitre-attack

S9023

NOOPDOOR

—

ESET HiddenFace 2024

https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf

Trend Micro Earth Kasha Updates APR 2025

https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html

JPCERT MirrorFace JUL 2024

https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html

Trend Micro Earth Kasha NOV 2024

https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html