What tactics and techniques does MirrorFace use?

How MirrorFace’s playbook fits into a typical intrusion chain

MirrorFace is best understood as an intrusion set that combines social engineering, account compromise and post-compromise tradecraft. The initial access path is usually targeted phishing, but the more important pattern is what happens after theft of credentials: attackers use real mailboxes and trusted web services to move through the environment with less friction and more credibility.

That combination matters because the campaign is not just about stealing a login. It is about turning one compromised account into a platform for reconnaissance, impersonation and follow-on delivery, while reducing the chance that defenders will immediately classify the activity as hostile.

MirrorFace also blends malware with living-off-the-land activity, which means defenders need to think beyond file-based detection. When a campaign alternates between malicious binaries and legitimate admin or scripting features, the observable signs can look like ordinary operations until the sequence is reconstructed.

Why mailbox and web-service abuse is so effective

Once an attacker has access to a mailbox, they inherit a communications channel that already has trust relationships, history and context. That makes it useful for internal reconnaissance, message interception, impersonation and further delivery because recipients are more likely to open or respond to traffic that appears to come from a known account.

Abuse of web services can extend the same advantage into collaboration platforms, file-sharing systems and other cloud-adjacent services. In practice, that means the attacker is not only stealing data, but also reusing legitimate channels to spread malicious content, harvest more credentials or stage the next phase of the intrusion.

A good Top 10 Phishing Techniques lens helps explain why this works so well: targeted phishing, consent abuse and session theft often produce more durable access than a simple password grab.

What defenders should look for in the tradecraft

The most useful detection approach is to correlate identity, mail and endpoint signals rather than treating each symptom in isolation. Suspicious sign-in patterns, new forwarding rules, mailbox delegation changes, abnormal remote-access usage and unexpected script execution are all small signals that become more meaningful when they line up around the same account.

Monitor for activity that shows the attacker is trying to preserve access or expand reach, such as repeated sign-ins from unusual geographies, sign-ins that do not match the user’s normal work rhythm, or legitimate tools being invoked in an unusual order. That pattern often matters more than any single alert.

For campaign context, the Threat Actor Groups Guide is useful because it helps practitioners place MirrorFace in a broader threat-intelligence workflow, and the MITRE ATT&CK Enterprise Matrix is the most practical way to map the observed behaviours to credential access, phishing, persistence and lateral movement techniques.

Risk and Threat Considerations

MirrorFace’s most important risk is not just initial compromise, but the way stolen mail and service access can be used to make the intrusion look ordinary. That creates exposure for business email compromise, secondary phishing, data collection and persistence, especially when the attacker can operate through trusted systems already present in the environment.

Failure mechanism: Phishing or credential theft gives the attacker a real account, then mailbox rules, legitimate remote-access tools and living-off-the-land activity reduce the visibility of follow-on abuse while the intruder expands access.

Impact: Organisations can miss early compromise, lose control of trusted communication channels and face a wider blast radius than a simple single-account incident would suggest.

Practitioner Guidance

What to verify: Confirm whether the suspicious mailbox or service account has forwarding, delegation, OAuth consent or remote-access history that was not present before the alert. If the account can reach sensitive mail, collaboration data or administrative portals, treat it as a high-priority compromise candidate.

Decision rule: If the activity involves a real authenticated session or a mailbox that can deliver internal trust, prioritise session revocation, rule review and credential rotation before spending time proving whether the attacker already exfiltrated data.

Common mistake: Teams often overfocus on the phishing email and underfocus on the post-login behaviour. The more dangerous phase is usually the legitimate-looking access that follows, because that is where persistence and impersonation are built.

Practitioner takeaway: For MirrorFace-style activity, the key question is not whether a login was stolen, but whether the attacker has already converted that login into a durable trusted channel for reconnaissance and delivery.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?