Forensia CTI Core

Profile

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.

MITRE ATT&CK ↗

Techniques

43 ATT&CK techniques attributed to this actor.

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1005 Data from Local System T1007 System Service Discovery T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1027.013 Encrypted/Encoded File T1033 System Owner/User Discovery T1036.008 Masquerade File Type T1047 Windows Management Instrumentation T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol T1057 Process Discovery T1059.003 Windows Command Shell T1059.005 Visual Basic T1070.004 File Deletion T1071.002 File Transfer Protocols T1074.002 Remote Data Staging T1082 System Information Discovery T1083 File and Directory Discovery T1087.002 Domain Account T1090 Proxy T1114.001 Local Email Collection T1190 Exploit Public-Facing Application T1204.002 Malicious File T1221 Template Injection T1482 Domain Trust Discovery T1553.002 Code Signing T1556.002 Password Filter DLL T1560.001 Archive via Utility T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1574.001 DLL T1587.001 Malware T1588.002 Tool T1591 Gather Victim Org Information T1614.001 System Language Discovery T1684.001 Impersonation T1685 Disable or Modify Tools T1685.005 Clear Windows Event Logs T1686.003 Windows Host Firewall

Software

16 malware/tools attributed to this actor.

NetTasklistPingipconfignbtstatCobalt StrikeBITSAdminUPPERCUTNltestWevtutilLODEINFODOWNIISSAMirrorStealerHiddenFaceNOOPLDRROAMINGHOUSE

Related corpus activity

9,962 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to MirrorFace.

Indicator	Type	Family	Sev	Src
cve-2026-3102	cve	—	85	3
cve-2026-1969	cve	—	85	1
cve-2013-3307	cve	—	85	2
cve-2014-2321	cve	—	85	1
cve-2025-34117	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2025-66478	cve	—	85	2
cve-2021-27076	cve	—	85	1
cve-2016-15047	cve	—	85	4
cve-2018-8007	cve	—	85	1
cve-2020-17456	cve	—	85	1
cve-2025-2492	cve	—	85	2
cve-2017-18377	cve	—	85	1
cve-2021-25646	cve	—	85	1
cve-2022-47945	cve	—	85	1
cve-2016-5681	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2025-34054	cve	—	85	4
cve-2024-1781	cve	—	85	1
cve-2023-44976	cve	ransomware	85	2
cve-2021-4045	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2020-22658	cve	—	85	2
cve-2025-23304	cve	—	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2013-7471	cve	—	85	1
cve-2026-0740	cve	—	85	1

Showing the top 30 by severity of 9,962.