MirrorFace is a China-aligned espionage group that has spent years stealing security and technology information from Japanese organisations, first through political and think tank spear phishing and later through exploited VPN appliances, with custom backdoors such as LODEINFO, NOOPDOOR and HiddenFace. In January 2025 Japan's National Police Agency (NPA) and National Cybersecurity Office warned publicly about the campaign, and in 2024 ESET reported the group's first known European victim. This profile covers its names and its relationship to APT10, targeting, the techniques MITRE ATT&CK records for it, how it steals and abuses credentials, notable reported campaigns, and detection and defence, including specific Windows events from JPCERT/CC. It is written for security teams in Japan and the wider Asia-Pacific region, in government, defence, aerospace, semiconductors, academia, media and think tanks, and for European organisations working with Japanese partners. Attribution statements are those of the named sources.
Key takeaways
- Japan's government has named it. The NPA and National Cybersecurity Office assessed in January 2025 that MirrorFace activity since about 2019 was an organised cyber attack in which Chinese involvement is suspected, aimed mainly at Japan's security and advanced technology information.
- Edge devices replaced phishing for some targets. JPCERT/CC reported in July 2024 confirmed exploitation of Array AG and FortiGate devices, with a shift since 2023 towards manufacturers and research institutions.
- Directory credentials are the target. JPCERT/CC and ATT&CK record LSASS dumping, NTDS.dit copied through volume shadow copies, SAM, SYSTEM and SECURITY hive theft, and a password filter DLL that captures new passwords as users change them.
- It hides in legitimate features. ESET reported abuse of Visual Studio Code remote tunnels and Windows Sandbox in 2024, and ATT&CK records log clearing and disabling Microsoft Defender.
- Logging is the main defence gap. JPCERT/CC lists Event IDs 5145, 1011, 4698, 2004, 1102 and 5001 as worth monitoring; most organisations do not collect all of them.
Who they are (names and aliases)
MITRE ATT&CK (G1054) describes MirrorFace as a People's Republic of China-aligned cyber espionage actor believed to be a subgroup under the menuPass (APT10) umbrella based on targeting, tool and infrastructure overlaps. It has been active since at least 2019, first targeting only Japanese organisations in media, defence, diplomatic, financial, manufacturing and academic sectors, and later targets in Central Europe.
| Name | Used by | Notes |
|---|---|---|
| MirrorFace (G1054) | ESET; MITRE ATT&CK; Japan NPA; JPCERT/CC | Primary name in Japanese government and ATT&CK material |
| Earth Kasha | Trend Micro; listed in ATT&CK | Trend Micro treats the APT10 link as potential only |
| APT10 / menuPass (G0045) | ESET (2025) and ATT&CK describe MirrorFace as a subgroup | Kaspersky's 2022 LODEINFO research was published under the APT10 name |
ESET says in its March 2025 report that it now considers MirrorFace a subgroup under the APT10 umbrella, citing use of the ANEL backdoor (also called UPPERCUT), similar targeting and code similarities. ESET also notes that Trend Micro still considers the link only potential. Read the APT10 Threat Actor Profile Guide for the parent cluster and the China State Cyber Operations Guide for context.
Targeting and motivation
- National security and advanced technology: the NPA's January 2025 assessment names information on Japan's security and advanced technology as the main aim.
- Politics: ESET's Operation LiberalFace (published December 2022) targeted Japanese political entities, especially members of one party, in the weeks before the 10 July 2022 House of Councillors election.
- Media, think tanks and universities: JPCERT/CC lists these as early targets, with a shift since 2023 towards manufacturers and research institutions.
- Diplomacy beyond Japan: ESET's Operation AkaiRyu hit a Central European diplomatic institute in August 2024 using an Expo 2025 Osaka lure, the first European target ESET has seen for the group.
- Regional spread: ATT&CK cites Trend Micro's April 2025 report on Earth Kasha campaigns targeting Taiwan and Japan.
Tactics and techniques (MITRE ATT&CK)
ATT&CK v20 links MirrorFace to 43 techniques and to software including LODEINFO, NOOPLDR, HiddenFace, UPPERCUT (ANEL), MirrorStealer, ROAMINGHOUSE, DOWNIISSA and Cobalt Strike. All IDs below are listed for G1054, except T1219.001 and T1564.006, which map ESET's 2025 findings and are marked.
| Tactic | Technique | How it shows up |
|---|---|---|
| Reconnaissance | T1591 Gather Victim Org Information | Content tailored to members of particular political parties |
| Initial access | T1190 Exploit Public-Facing Application | FortiGate and Array AG devices |
| Initial access | T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link | Word, Excel and self-extracting archives; OneDrive links to ZIPs with LNK files |
| Stealth | T1684.001 Impersonation | Emails purporting to be from a Japanese party's PR department |
| Execution | T1221 Template Injection; T1059.005 Visual Basic | Remote templates with VBA retrieving payloads |
| Stealth | T1574.001 DLL; T1036.008 Masquerade File Type; T1553.002 Code Signing | Side-loading through legitimate EXEs; payloads disguised as PEM files; data appended to valid signatures |
| Stealth | T1564.006 Run Virtual Instance (ESET 2025, not in G1054) | Malware run inside Windows Sandbox to hide from host security tools |
| Command and control | T1219.001 IDE Tunneling (ESET 2025, not in G1054); T1090 Proxy | VS Code remote tunnels; GOST proxy tool |
| Credential access | T1003.001 LSASS Memory; T1003.002 SAM; T1003.003 NTDS | LSASS dumps; hives and NTDS.dit copied via volume shadow copies |
| Credential access | T1556.002 Password Filter DLL | MRSAStealer registered as a password filter to collect passwords on change |
| Defense impairment | T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs; T1686.003 Windows Host Firewall | Defender disabled, logs deleted, firewall opened for backdoor ports |
| Lateral movement | T1021.002 SMB/Windows Admin Shares; T1021.001 Remote Desktop Protocol | Malware copied over SMB; RDP used to move files |
| Collection and exfiltration | T1114.001 Local Email Collection; T1560.001 Archive via Utility; T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | Stored mail stolen; RAR archives sent out over SFTP |
How they abuse identities and credentials
- Enter as the VPN: exploiting an Array AG or FortiGate device gives the group a position inside the trust boundary, often with access to the appliance's own service and authentication configuration. See the Edge Device Exploitation by Threat Actors Guide and the VPN Security Guide.
- Take the whole directory: copying NTDS.dit through volume shadow copies yields password hashes for every domain account, including service accounts and
krbtgt. Treat this as a full domain compromise. See the Credential Dumping Guide. - Catch new passwords as they are set: a password filter DLL on a domain controller receives each new password in clear text when users change it. A password reset after detection hands the attacker the new password unless the filter is removed first.
- Steal mail client and browser secrets: ESET found MirrorStealer collecting credentials from browsers and email clients, including Becky!, a Japan-specific client, and the operator manually copying Chrome and Edge cookie files.
- Use legitimate developer tunnels: VS Code remote tunnels authenticate through a GitHub or Microsoft account the attacker controls, so the traffic goes to Microsoft infrastructure and looks like normal developer activity. See the Developer Workstation and IDE Security Guide.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| Since about 2019 | Campaign against Japanese organisations and individuals | Japan NPA and National Cybersecurity Office, January 2025 |
| June to July 2022 | Operation LiberalFace: party PR department lures before the House of Councillors election; LODEINFO and MirrorStealer | ESET, 14 December 2022 |
| 2022 | LODEINFO tracking published under the APT10 name | Kaspersky, October 2022, cited in ATT&CK |
| 2023 to 2024 | Array AG and FortiGate exploitation; NOOPDOOR backdoor; shift to manufacturing and research; JPCERT/CC alert in November 2023 | JPCERT/CC, 16 July 2024 |
| August 2024 | Operation AkaiRyu against a Central European diplomatic institute; ANEL revived; VS Code tunnels and Windows Sandbox abuse | ESET, 18 March 2025 |
| 8 January 2025 | Public warning and attribution by Japanese authorities, with supplements on Windows Sandbox and VS Code abuse | Japan NPA |
Japan's Active Cyber Defence legislation is part of the policy response to campaigns like this. See the Japan Active Cyber Defence Act Guide.
Detection and defence
Windows events to collect (from JPCERT/CC)
| Event ID | Log | What it shows |
|---|---|---|
| 5145 | Security (requires "Audit Detailed File Share") | SMB share access, used to spot malware copied between hosts |
| 1011 | Microsoft Defender | LSASS dump detection |
| 4698 | Security | A scheduled task was created |
| 2004 | Windows Firewall | A firewall rule was added, for example for backdoor ports |
| 1102 | Security | The audit log was cleared |
| 5001 | Microsoft Defender | Real-time protection was disabled |
JPCERT/CC also recommends watching for reconnaissance commands ordinary users rarely run, such as auditpol, dsregcmd, setspn and vssadmin, and paying close attention to file servers, AD servers and antivirus management servers.
Controls mapped to behaviours
| Behaviour | Control | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|---|
| Edge device exploitation (T1190) | Patch or replace VPN appliances fast; forward appliance logs; check integrity after advisories | SI-2, RA-5, SA-22 | ID.RA-01, PR.PS-02 |
| NTDS and hive theft (T1003.003, T1003.002) | Alert on vssadmin and shadow copy creation on DCs; tier 0 isolation | AC-6, SI-4 | DE.CM-09 |
| Password filter (T1556.002) | Baseline the Notification Packages value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa on DCs and alert on change | CM-2, SI-7 | PR.PS-01 |
| VS Code tunnels (T1219.001) | Block or allow-list tunnel domains at the proxy; control VS Code via policy on non-developer hosts | CM-7, SC-7 | PR.IR-01 |
| Windows Sandbox abuse (T1564.006) | Disable the Windows Sandbox optional feature where not needed; alert when it is enabled | CM-7 | PR.PS-01 |
| Log clearing and Defender tampering (T1685, T1685.005) | Tamper protection; forward logs off-host in near real time | AU-9, AU-6 | DE.CM-09 |
Phased rollout
- Week 1: confirm all Array AG, FortiGate and other remote access appliances are on supported, patched firmware. Review JPCERT/CC and vendor indicators against appliance and proxy logs.
- Weeks 2 to 3: enable "Audit Detailed File Share" on file servers in a pilot, measure log volume, then extend. Forward Security, Defender and Firewall logs to a central store.
- Month 2: baseline LSA notification packages on every domain controller, enable Defender tamper protection, and disable Windows Sandbox and VS Code tunnels on hosts that do not need them. Roll back per group policy object if a business application depends on them.
- If compromise is found: remove password filters and backdoors before any password reset, then reset all privileged and service accounts and
krbtgttwice. - Ongoing: run spear phishing awareness for political, media and research staff using LiberalFace and AkaiRyu style lures.
Metrics
- Days to patch remote access appliances after a vendor advisory.
- Percentage of file servers and DCs forwarding Event IDs 5145, 4698 and 1102.
- Percentage of endpoints with Defender tamper protection on.
- Number of hosts with Windows Sandbox enabled outside approved groups.
- Time from appliance advisory to integrity check completion.
Small Japanese firms in a defence or semiconductor supply chain should prioritise appliance patching, a managed detection service that collects the events above, and phishing-resistant MFA. Large organisations should add tier 0 isolation and regular compromise assessments of domain controllers.
Common failure patterns
- Resetting passwords with a filter still installed: the attacker receives every new password.
- Not collecting share access logs: Event ID 5145 is off by default, so SMB-based lateral movement goes unseen.
- Trusting Microsoft-hosted traffic: VS Code tunnels and OneDrive links use reputable domains.
- Treating the VPN appliance as a black box: without forwarded logs and integrity checks, the entry point stays invisible.
- Relying on local logs: the group clears event logs and disables Defender.
Practitioner checklist
- Patch or replace internet-facing VPN and remote access appliances and forward their logs.
- Enable "Audit Detailed File Share" and collect Event IDs 5145, 1011, 4698, 2004, 1102 and 5001.
- Alert on
vssadmin, shadow copy creation and hive export on domain controllers. - Baseline LSA notification packages on DCs and alert on changes.
- Disable Windows Sandbox and VS Code tunnels where they are not needed.
- Turn on Defender tamper protection and off-host log forwarding.
- Train political, media and research staff on party, NGO and event-themed lures.
- Map MirrorFace, Earth Kasha and APT10 references together in threat intelligence tools.
Standards and references
- Japan National Police Agency: Warning on MirrorFace cyber attacks (January 2025)
- JPCERT/CC: MirrorFace Attack against Japanese Organisations
- MITRE ATT&CK: MirrorFace (G1054)
- ESET: Operation AkaiRyu, MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor
- ESET: Unmasking MirrorFace, Operation LiberalFace targeting Japanese political entities
- MITRE ATT&CK: Modify Authentication Process, Password Filter DLL (T1556.002)
- MITRE ATT&CK: Remote Access Tools, IDE Tunneling (T1219.001)
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Threat Actor Groups Guide · APT10 Threat Actor Profile Guide · Edge Device Exploitation by Threat Actors Guide · Credential Dumping Guide · Japan Active Cyber Defence Act Guide