G1054 · ATT&CK 19.1 group

MirrorFace

[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent [MirrorFace](https://attack.mitre.org/groups/G1054) operations included targets in Central Europe and featured use of [LODEINFO](https://attack.mitre.org/software/S9020), [HiddenFace](https://attack.mitre.org/software/S9023), and [UPPERCUT](https://attack.mitre.org/software/S0275) malware.(Citation: Kaspersky LODEINFO OCT 2022)(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ESET MirrorFace DEC 2022)(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

Aliases: Earth Kasha, MirrorFace

Mapped techniques (43)

T1003.001T1003.002T1003.003T1005T1007T1016T1018T1021.001T1021.002T1027.013T1033T1036.008T1047T1048.002T1057T1059.003T1059.005T1070.004T1071.002T1074.002T1082T1083T1087.002T1090T1114.001T1190T1204.002T1221T1482T1553.002T1556.002T1560.001T1566.001T1566.002T1574.001T1587.001T1588.002T1591T1614.001T1684.001T1685T1685.005T1686.003

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 2 — The Intelligence Cycle Intelligence Types
Cyber Threat Intelligence (CTI) · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 6 — The Threat Actor Landscape
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Career Path Continuing Education
Cyber Threat Intelligence (CTI) · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name