MirrorFace

OriginChina

Techniques (MITRE ATT&CK)43

SourceMITRE ATT&CK

Also known as:Earth Kasha

Vexday analysis

MirrorFace é um ator de ciberespionagem alinhado à República Popular da China, identificado pelo MITRE ATT&CK como G1054 e também referenciado como Earth Kasha. Acredita-se que seja um subgrupo sob o guarda-chuva do menuPass, com base em sobreposições de alvos, ferramentas e infraestrutura. Ativo desde pelo menos 2019, o grupo inicialmente concentrou suas operações exclusivamente em organizações japonesas nos setores de mídia, defesa, diplomacia, finanças, manufatura e meio acadêmico, expandindo posteriormente suas operações para alvos na Europa Central, com uso dos malwares LODEINFO, HiddenFace e UPPERCUT. Ao grupo são atribuídas 2 CVEs conhecidas por exploração e 43 técnicas documentadas no framework MITRE ATT&CK.

Techniques (MITRE ATT&CK) 43

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Org Information

Resource development

Malware Tool

Initial access

Exploit Public-Facing Application Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Windows Command Shell Visual Basic Malicious File

Credential access

LSASS Memory Security Account Manager NTDS

Discovery

System Service Discovery System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Process Discovery System Information Discovery File and Directory Discovery Domain Account Domain Trust Discovery System Language Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares

Collection

Data from Local System Remote Data Staging Local Email Collection Archive via Utility

Command and control

File Transfer Protocols Proxy

Exfiltration

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

defense-impairment

Code Signing Password Filter DLL Disable or Modify Tools Clear Windows Event Logs Windows Host Firewall

stealth

Encrypted/Encoded File Masquerade File Type File Deletion Template Injection DLL Impersonation

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2014-7169CRITICALEPSS 100%KEV CVE-2016-6662EPSS 68%

MirrorFace uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →