MirrorFace

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

Qrupun mənşəyi Çin kimi bildirilir.

Qrup 2 zərərli proqram ailəsi ilə əlaqələndirilib.

Digər adları: Earth Kasha

Qrup 2 zərərli proqram ailəsi ilə əlaqələndirilib.

Bu aktor haqqında dərc edilmiş hesabatlar:

• https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/
• https://web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf
• https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/

Mənbə: MISP Galaxy, Malpedia.