G1054 MirrorFace
Enterprisealso known asMirrorFace · Earth Kasha
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.
01
canonical actor
The group this is attributed to.
02
techniques used (43)
ATT&CK techniques this enables or maps to.
showing 20 of 43
03
software used (16)
Malware and tools associated with this.
04
campaigns (1)
Campaigns that use this.
05
source
Where this definition is published.