MirrorFace· China

MirrorFace is a Chinese-speaking threat group targeting high-value entities in Japan.

Analyst brief

MirrorFace (also tracked as Earth Kasha) is a Chinese-speaking threat group targeting high-value entities in Japan, including media, government, diplomatic, and political sectors. The actor primarily gains initial access via Spearphishing Attachment/Link techniques and leverages malware such as Cobalt Strike, MirrorStealer, and LODEINFO to steal credentials and exfiltrate sensitive data. Defenders should pay close attention to Exfiltration Over Asymmetric Encrypted Non-C2 Protocol (T1048.002), monitor lateral movement attempts via RDP, and track the abuse of tools like BITSAdmin and Wevtutil.

MirrorFace

Earth Kasha

unknown

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

origin (suspected)

China

techniques · ATT&CK

Gather Victim Org Information Malware Spearphishing Attachment Spearphishing Link Malicious File File Deletion Security Account Manager Process Discovery+8

malware

Cobalt Strike MirrorStealer UPPERCUT LODEINFO ROAMINGHOUSE DOWNIISSA+10

source: misp-galaxy + mitre-attackG1054 10 refs →

Kill-chain playbook12

01
reconnaissance
T1591
Monitor network traffic and user activity for gathering victim org information.
02
resource-development
T1587.001
Monitor for suspicious activities related to developing and distributing malware.
03
initial-access
T1566.001 T1566.002
Monitor for suspicious email attachments and links, and educate users on spearphishing attempts.
04
execution
T1204.002
Monitor for suspicious file execution and protect endpoints from malicious files.
05
stealth
T1070.004
Monitor file deletion activities and detect suspicious changes on the system.
06
credential-access
T1003.002
Monitor Security Account Manager (SAM) access and prevent account credential theft.
07
discovery
T1057 T1087.002
Monitor process discovery and domain account enumeration, detect suspicious activities.
08
lateral-movement
T1021.001
Monitor Remote Desktop Protocol (RDP) activities and block suspicious RDP connections.
09
collection
T1005 T1074.002
Monitor data collection from local system and remote staging, detect suspicious data transfer.
10
command-and-control
T1090
Monitor proxy usage and detect suspicious network activities.
11
exfiltration
T1048.002
Monitor exfiltration over asymmetric encrypted non-C2 protocol and block suspicious data transfer.
12
defense-impairment
T1685 T1686.003
Monitor disabling or modifying security tools, including Windows Host Firewall changes.

FAQ2

Which sectors does MirrorFace primarily target?

MirrorFace targets media, government, diplomatic, and political entities in Japan.

What tactic does MirrorFace use for initial access?

MirrorFace primarily relies on Spearphishing Attachment/Link techniques for initial access.

MirrorFace· China

Analyst brief

MirrorFace

Kill-chain playbook12

reconnaissance

resource-development

initial-access

execution

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

defense-impairment

FAQ2

See also3

MirrorFace· China

Analyst brief

MirrorFace

Kill-chain playbook12

reconnaissance

resource-development

initial-access

execution

stealth

credential-access

discovery

lateral-movement

collection

command-and-control

exfiltration

defense-impairment

FAQ2

See also3