- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2019–2026
- Status
- Active
- ATT&CK
- G1054 · 43 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0136 · mirrorface
ChinaWhat it is
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Trend Micro
- Earth Kasha
- Operations
- Operation LiberalFace, Operation LiberalFace, MirrorFace, Operation “AkaiRyū”
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTChina
- MISP Galaxy (CFR tagging)China
- ThreatActor.info (Malpedia et al.)China · high
Targets
- Countries
- Japan
- Sectors
- Government
Tools
The tools and malware families the sources tie to it.
- Anel
- AsyncRAT
- BITSAdmin
- China Chopper
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- DOWNIISSA
- HiddenFace
- LODEINFO
- MirrorStealer
- NOOPLDR
- Net
- Nltest
- Ping
- ROAMINGHOUSE
- Tasklist
- UPPERCUT
- Umbreon
- Wevtutil
- ipconfig
- nbtstat
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de