MirrorFace
MirrorFace is classified as other threat group.
- Malware families
- 2
- Origin
- China
- Also known as
- 1
MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.
The group's reported origin is China.
The group is associated with 2 malware families.
Also known as: Earth Kasha
The group is associated with 2 malware families.
Malware families
- LODEINFO
- NOOPDOOR
Published reports on this actor:
- https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/
- https://web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf
- https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.