MirrorFace — ATT&CK profile, 43 techniques

Overview

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

Naming & attribution

MirrorFace is tracked under 2 names across the industry. It uses 43 documented ATT&CK techniques — more than 78% of the 174 groups tracked here. Activity attributed since at least 2019.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Earth Kasha	Trend Micro

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1556.002 Password Filter DLL — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

menuPass China — 20 shared techniques (29% overlap)
Play — 15 shared techniques (28% overlap)
Ke3chang China — 19 shared techniques (27% overlap)
FIN8 — 17 shared techniques (27% overlap)
APT41 China — 26 shared techniques (26% overlap)
Magic Hound Iran — 24 shared techniques (25% overlap)

Capabilities

Exploitation of public-facing / client applications — ATT&CK T1190
Custom malware/implant development — ATT&CK: 8 attributed custom malware families

TTPs — 43 techniques across 12 tactics

Reconnaissance

T1591 Gather Victim Org Information

Resource Development

T1587.001 Malware
T1588.002 Tool

Defense Impairment

Credential Access

T1003.001 LSASS Memory
T1003.002 Security Account Manager
T1003.003 NTDS

Discovery

T1007 System Service Discovery
T1016 System Network Configuration Discovery
T1018 Remote System Discovery
T1033 System Owner/User Discovery
T1057 Process Discovery
T1082 System Information Discovery
T1083 File and Directory Discovery
T1087.002 Domain Account
T1482 Domain Trust Discovery
T1614.001 System Language Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol
T1021.002 SMB/Windows Admin Shares

Collection

Command and Control

T1071.002 File Transfer Protocols
T1090 Proxy

Exfiltration

T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Tools & malware (16)

Net · Cobalt Strike · MirrorStealer · UPPERCUT · Nltest · BITSAdmin · Tasklist · ipconfig · LODEINFO · ROAMINGHOUSE · DOWNIISSA · nbtstat · HiddenFace · Ping · Wevtutil · NOOPLDR

Reporting (3)

Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan — Hiroaki, H
Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella — Trend Micro
MirrorFace Attack against Japanese Organisations — Tomonaga, S