APT GroupSOCRadar source-of-truth import; pending cross-source consensus confidence

MirrorFace

MirrorFace, also known as Earth Kasha, is a China-aligned cyberespionage threat actor that emerged in at least 2019, primarily targeting Japanese organizations for intelligence gathering. Initially, the group focused almost exclusively on entities in Japan, but by 2024, its operations expanded to include targets in Central Europe. MirrorFace is assessed to be a subgroup operating under the larger menuPass umbrella, also known as APT10, an attribution ESET began making in 2024. The group's defining characteristic lies in its persistent focus on cyberespionage, utilizing a distinct set of custom malware families like LODEINFO and HiddenFace, alongside the recent reintroduction of the ANEL backdoor, which was previously exclusive to APT10. Their operations are designed to exfiltrate sensitive data and credentials, setting them apart through a combination of traditional and evolving tactics to achieve their intelligence objectives.

Directory Briefing

Top 10 Talking Points

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to External Remote Services and Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

The retained sequence includes File and Directory Discovery, Account Discovery, OS Credential Dumping, Create Process with Token, and SMB/Windows Admin Shares, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.^1,2

Evidence includes OS Credential Dumping and Create Process with Token; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Retained persistence behavior includes Scheduled Task/Job, Scheduled Task, Windows Service, and Boot or Logon Autostart Execution; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.^1,2

Reported tooling or behavior includes SMB/Windows Admin Shares, Windows Management Instrumentation, and Visual Basic; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Data from Network Shared Drive and Archive via Utility, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

Retained targeting includes Public Administration, Public Relations Agencies, Manufacturing, Information Services, and Finance across Japan, Papua New Guinea, and Taiwan, Province of China; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to External Remote Services and Phishing; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Evidence includes OS Credential Dumping and Create Process with Token; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.^1,2

The retained record includes Data from Network Shared Drive and Archive via Utility, making repository, email, cloud, and egress review central to impact assessment.

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type^1,2

APT Group profile

First Seen^1,2

2019-01-01

Last Seen^1,2

2025-03-01

Origin^1,2

Motivation^1,2

APT Group activity retained from SOCRadar

Primary Access Pattern^1,2

T1003 - OS Credential Dumping

Objective^1,2

APT Group activity retained from SOCRadar

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases^1,2

Earth KashaMirrorFace

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

JapanPapua New GuineaTaiwan, Province of China

Target Sectors¹

Public AdministrationPublic Relations AgenciesManufacturingInformation ServicesFinanceProfessional&Technical ServicesEducational ServicesArts & EntertainmentSpace & DefenseNational Security&International AffairsBankingComputer Systems Design and Related ServicesComputer Systems Design Services

Associated Activity^1,2

Initial Access: Spear-phishing emails containing malicious attachments (e.g., Word documents, LNK files, ZIP archives) or links to malicious OneDrive-hosted payloads.Execution & Persistence: Deployment and execution of custom malware such as LODEINFO, HiddenFace, ANEL, UPPERCUT, AsyncRAT, MirrorStealer, ROAMINGMOUSE, or ANELLDR.Execution & Persistence: Abuse of legitimate executables like McAfee and JustSystems applications for DLL sideloading to execute malicious code.Defense Evasion: Malware execution within Windows Sandbox environments to evade detection, or the clearing of Windows event logs and deletion of delivered tools and files.Defense Evasion: Usage of Base64 encoded shellcode in infection chains or crafting malware to appear as Privacy-Enhanced Mail (PEM) files.Command and Control: Utilization of Visual Studio Code remote tunnels or other legitimate tools like Cobalt Strike, PuTTY SCP client, FRP, Rubeus, GOST, or SharpHide for remote access and command execution.Discovery: Execution of native Windows commands and utilities such as cmd.exe, PowerShell, MSBuild, WMI, Tasklist, Ping, Arp, Nltest, Wevtutil, vssadmin, csvde.exe, and quser.exe for system and network reconnaissance.Collection: Targeting and exfiltration of specific file types, including .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf.Persistence: Modification of registry keys, such as the HKCU Run key, for malware persistence, as observed with LODEINFO.

ATT&CK IDs^1,2

T1003 - OS Credential DumpingT1003.001T1003.002T1003.003T1005T1007T1016T1018T1021T1021.001T1021.002 - SMB/Windows Admin SharesT1027 - Obfuscated Files or InformationT1027.001T1027.013T1033T1036 - MasqueradingT1036.005T1036.007T1036.008T1039 - Data from Network Shared DriveT1047 - Windows Management InstrumentationT1048T1048.002T1049T1052.001T1053 - Scheduled Task/JobT1053.005 - Scheduled TaskT1055 - Process InjectionT1057T1059T1059.001T1059.003T1059.005 - Visual BasicT1070T1070.001 - Clear Windows Event LogsT1070.004 - File DeletionT1070.006 - TimestompT1071T1071.001T1071.002T1071.004 - DNST1074T1074.001T1074.002T1078T1082T1083 - File and Directory DiscoveryT1087 - Account DiscoveryT1087.002T1090T1091T1102 - Web ServiceT1104 - Multi-Stage ChannelsT1105T1112 - Modify RegistryT1113 - Screen CaptureT1114T1114.001T1119T1127T1127.001 - MSBuildT1132 - Data EncodingT1133 - External Remote ServicesT1134.002 - Create Process with TokenT1137T1137.001T1140 - Deobfuscate/Decode Files or InformationT1190T1203T1204 - User ExecutionT1204.001T1204.002T1217T1218.004T1218.005T1219T1219.001T1221T1482T1518T1543.003 - Windows ServiceT1546.003T1547 - Boot or Logon Autostart ExecutionT1547.001T1553T1553.002T1556T1556.002T1560T1560.001 - Archive via UtilityT1560.003T1562.001 - Disable or Modify ToolsT1562.004 - Disable or Modify System FirewallT1564 - Hide ArtifactsT1564.001T1566 - PhishingT1566.001T1566.002T1568 - Dynamic ResolutionT1568.002 - Domain Generation AlgorithmsT1573.001T1573.002 - Asymmetric CryptographyT1574T1574.001T1574.002T1583.001T1585T1585.002T1585.003T1586T1586.002T1587T1587.001T1588T1588.002T1591T1608T1608.001T1608.005T1614T1614.001T1684T1684.001T1685T1685.005T1686T1686.003

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
Operation AkaiRyū²	Operation AkaiRyū (C0060) is attributed to MirrorFace (G1054) by MITRE ATT&CK Campaigns.

Indicators

IOCs And Observable Retention

SOCRadar reported 18¹IntelliOS retained 0

18 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source coverage: 2 source groups tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables¹

18 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source	Reported	Retained	Coverage Status
SOCRadar¹	18	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.
MITRE ATT&CK / CTI²	N/A	0	Technique and identity context retained; not treated as raw IOC feed for this card.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	MirrorFace	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	MirrorFace	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for MirrorFace.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	MITRE ATT&CK https://attack.mitre.org/groups/G1054	ATT&CK source for group, campaign, software, alias, and technique mappings where matched.
3	MITRE CTI https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json	Open MITRE CTI source for ATT&CK data.

Loading Threat Actor Cards

MirrorFace

Top 10 Talking Points

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

BLUF

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.1,2

Initial access should be scoped across identity and Internet-facing systems.1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1,2

Identity compromise is a central scoping issue.1,2

Persistence matters more than the first payload.1,2

Legitimate administration tools may carry much of the attack.1,2

The actor may reduce visibility before the main objective is reached.1,2

Collection and exfiltration reveal the likely mission.1,2

Victimology is broad enough that sector alone is weak negative evidence.1

The first briefing should separate containment confidence from attribution confidence.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2

MirrorFace should be treated as an intrusion cluster, not a single immutable toolkit.^1,2

Initial access should be scoped across identity and Internet-facing systems.^1,2

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.^1,2

Identity compromise is a central scoping issue.^1,2

Persistence matters more than the first payload.^1,2

Legitimate administration tools may carry much of the attack.^1,2

The actor may reduce visibility before the main objective is reached.^1,2

Collection and exfiltration reveal the likely mission.^1,2

Victimology is broad enough that sector alone is weak negative evidence.¹

The first briefing should separate containment confidence from attribution confidence.^1,2