Loading threat actor…
MirrorFace, also tracked as Earth Kasha, is a China-aligned cyber-espionage threat actor assessed as a subgroup within the APT10 umbrella. Active since at least 2019, the group has focused primarily on intelligence collection against organizations in Japan, especially government, political entities, think tanks, academia, media, diplomatic organizations, and defense-, high-tech-, and manufacturing-related targets. In late 2024, the group expanded beyond its longstanding Japan-centric victimology and was observed targeting a Central European diplomatic institute in an operation known as AkaiRyū. MirrorFace is known for targeted spear-phishing using politically and diplomatically themed lures, including impersonation of trusted Japanese organizations and parties. It has also exploited vulnerabilities in internet-facing enterprise products such as SSL-VPN, file-transfer, and proxy appliances. Observed malware and tooling associated with the group include LODEINFO, HiddenFace (also called NOOPDOOR), ANELLDR, the revived ANEL backdoor, LilimRAT, and a heavily customized AsyncRAT variant. HiddenFace is regarded as a modular backdoor used exclusively in MirrorFace operations, while LODEINFO was a long-running fileless implant family heavily used in earlier campaigns. The actor’s tradecraft includes DLL side-loading with legitimate signed executables, in-memory loading of payloads, PowerShell-based execution, use of the Windows command shell for execution and file manipulation, and use of Remote Desktop Protocol for exfiltration of collected files. MirrorFace has demonstrated strong defense-evasion and anti-forensics discipline, including obfuscation, Base64-encoded shellcode, deletion of malware and collected archives, clearing Windows event logs, and abuse of Windows Sandbox to execute malware in an isolated environment with reduced visibility to host security tooling. The group has also abused Visual Studio Code Remote Tunnels for stealthy encrypted remote access. MirrorFace conducts post-compromise collection focused on documents and locally stored data of intelligence value. Reported behaviors include gathering files on victim machines, credential theft through associated tooling, keylogging in LODEINFO variants, process injection, persistence via scheduled tasks and autorun-style mechanisms, and modular command-and-control over web protocols and other encrypted channels. Its operational profile, victimology, and tooling lineage indicate an espionage mission aligned with Chinese state interests rather than financial gain.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
73 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as one of many threat actors associated with the detection's ATT&CK-style annotations for PowerShell and DNS TXT command-and-control behavior; no specific campaign or activity is described in this reference.
Listed only as an ATT&CK-associated actor in the annotation.
Mentioned only as one of many threat actors associated with the generic discovery technique of running the Linux id command.
Listed as an associated threat actor in detection annotations for Ghostscript exploitation; no specific campaign activity is described in this reference.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.