Free scan↗
  • English
  • Deutsch

MirrorFace

threat actor
01

also known as

Other names and identifiers for this entity.

ATT&CK

Earth Kasha · MirrorFace

02

resolved ATT&CK groups

Threat groups associated with this.

  • G1054MirrorFace
03

techniques used (43)

ATT&CK techniques this enables or maps to.

  • T1003.001LSASS Memory
  • T1003.002Security Account Manager
  • T1003.003NTDS
  • T1005Data from Local System
  • T1007System Service Discovery
  • T1016System Network Configuration Discovery
  • T1018Remote System Discovery
  • T1021.001Remote Desktop Protocol
  • T1021.002SMB/Windows Admin Shares
  • T1027.013Encrypted/Encoded File
  • T1033System Owner/User Discovery
  • T1036.008Masquerade File Type
  • T1047Windows Management Instrumentation
  • T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1057Process Discovery
  • T1059.003Windows Command Shell
  • T1059.005Visual Basic
  • T1070.004File Deletion
  • T1071.002File Transfer Protocols
  • T1074.002Remote Data Staging
showing 20 of 43
04

campaigns (1)

Campaigns that use this.

  • C0060Operation AkaiRyū
05

software used (16)

Malware and tools associated with this.

  • S0190BITSAdmin
  • S0154Cobalt Strike
  • S9021DOWNIISSA
  • S9023HiddenFace
  • S9020LODEINFO
  • S9022MirrorStealer
  • S9025NOOPLDR
  • S0039Net
  • S0359Nltest
  • S0097Ping
  • S9026ROAMINGHOUSE
  • S0057Tasklist
  • S0275UPPERCUT
  • S0645Wevtutil
  • S0100ipconfig
  • S0102nbtstat
by temnirPrivacySources
Built in Europe© 2026 datadir s.r.o.
v0.1.142checking…