Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · MirrorFace · Unknown · assessed origin China · misp-galaxy + mitre-attack · refreshed 2026-10-06

MirrorFace

  • Earth Kasha

MITRE G1054 ↗

MirrorFace — ATT&CK roseMI

attack rose · 43 techniques across 12 tactics

Analyst brief

misp-galaxy + mitre-attack

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

43 techniques · 12 of 15 tactics

  1. Reconnaissance

    1 technique

  2. Resource development

    2 techniques

  3. Initial access

    3 techniques

  4. Execution

    4 techniques

  5. Stealth

    6 techniques

  6. Defense impairment

    5 techniques

  7. Credential access

    3 techniques

  8. Discovery

    10 techniques

  9. Lateral movement

    2 techniques

  10. Collection

    4 techniques

  11. Command and control

    2 techniques

  12. Exfiltration

    1 technique

select a technique

Arsenal

8 malware · 8 tools
Malware
Malware · 8ATT&CK
Cobalt StrikeS0154 ↗
MirrorStealerS9022 ↗
UPPERCUTS0275 ↗
LODEINFOS9020 ↗
ROAMINGHOUSES9026 ↗
DOWNIISSAS9021 ↗
HiddenFaceS9023 ↗
NOOPLDRS9025 ↗
Tools
Tools · 8ATT&CK
NetS0039 ↗
NltestS0359 ↗
BITSAdminS0190 ↗
TasklistS0057 ↗
ipconfigS0100 ↗
nbtstatS0102 ↗
PingS0097 ↗
WevtutilS0645 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to MirrorFace

none on KEV
  1. CVE-2023-35192026-10-17
    1. “Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.”

      cited as used in a campaign · named nearby · source: trendmicro.com ↗ · 2026-10-17

  2. CVE-2023-34662026-10-17
    1. “Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.”

      cited as used in a campaign · named nearby · source: trendmicro.com ↗ · 2026-10-17

  3. CVE-2023-34672026-10-17
    1. “Citrix (CVE-2023-3466, CVE-2023-3467, CVE-2023-3519), which were abused in the LODEINFO Campaign #2 in 2023 as well.”

      cited as used in a campaign · named nearby · source: trendmicro.com ↗ · 2026-10-17

  4. CVE-2023-279972026-10-17
    1. “The vulnerability of CVE-2023-27997 was 0-day at the time of usage in both campaigns by Volt Typhoon and Earth Kasha”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  5. CVE-2023-457272026-10-17
    1. “We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461) , Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997) , were abused in the wild. Earth Kasha was changing these vulnerabilities to abuse from time to time.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  6. CVE-2023-284612026-10-17
    1. “We observed that vulnerabilities of enterprise products, such as Array AG (CVE-2023-28461) , Proself (CVE-2023-45727) and FortiOS/FortiProxy (CVE-2023-27997) , were abused in the wild. Earth Kasha was changing these vulnerabilities to abuse from time to time.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

10 sources
  1. 1.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-…
  2. 2.web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf
  3. 3.blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat
  4. 4.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth…
  5. 5.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.h…
  6. 6.attack.mitre.org/groups/G1054
  7. 7.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html
  8. 8.securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742
  9. 9.securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745
  10. 10.blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisa…

Track MirrorFace on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.