{
  "id": "mirrorface",
  "name": "MirrorFace",
  "aliases": [
    "Earth Kasha"
  ],
  "domain": "cyber",
  "country": "CHN",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "CHN"
  ],
  "summary": "MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors.",
  "specs": [
    {
      "k": "sponsor",
      "v": "PRC-aligned; assessed subgroup of menuPass",
      "src": [
        "mitre-g1054"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2019,
      "src": [
        "mitre-g1054"
      ],
      "conf": "medium",
      "note": "At least 2019"
    },
    {
      "k": "attack_id",
      "v": "G1054",
      "src": [
        "mitre-g1054"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps.",
      "src": [
        "mitre-g1054"
      ],
      "conf": "medium"
    },
    {
      "k": "campaigns",
      "v": "Operation AkaiRyū (C0060, 2024–2024)",
      "src": [
        "mitre-g1054"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 43,
      "src": [
        "mitre-g1054"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BITSAdmin, Cobalt Strike, DOWNIISSA, HiddenFace, ipconfig, LODEINFO, MirrorStealer, nbtstat, Net, Nltest, NOOPLDR, Ping, ROAMINGHOUSE, Tasklist, UPPERCUT, Wevtutil",
      "src": [
        "mitre-g1054"
      ],
      "conf": "high",
      "note": "16 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1054)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/mirrorface.html",
  "sources": {
    "mitre-g1054": {
      "title": "MirrorFace, Group G1054",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1054/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}