ChinaAttributedChina-linkedEspionageActive 2019 – 2025MirrorFace
Also known asEarth Kasha
Summary
PRC-aligned espionage actor (MITRE G1054; Trend Micro's Earth Kasha) that MITRE and ESET treat as a subgroup under the APT10 umbrella. Japan's National Police Agency and NISC attributed to it over 200 incidents between 2019 and 2024 against government bodies, politicians, think tanks, media, defence, space research and advanced-technology firms, using lures such as 'Japan-US alliance' and 'Taiwan Strait' and running malware inside Windows Sandbox to evade detection. Tooling: LODEINFO, NOOPDOOR, HiddenFace and the revived ANEL (UPPERCUT) backdoor. ESET's Operation AkaiRyū (Jun–Sep 2024) used Expo 2025 lures against a Central European diplomatic institute — its first European target; Trend Micro saw a Mar 2025 wave against Taiwan and Japan government delivering ROAMINGMOUSE → ANEL / NOOPDOOR.
Attribution
Believed a subgroup under the APT10 umbrella
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- Japan National Police Agency and NISC (Government, 2025-01-08)
Assess that MirrorFace (Earth Kasha) ran the campaign against Japan since about 2019 - MITRE ATT&CK (MITRE ATT&CK, 2026-10)
PRC-aligned; believed a subgroup under the menuPass (APT10) umbrella
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Earth Kasha spear-phishing of Taiwan and Japan government — ROAMINGMOUSE → ANEL / NOOPDOOR | 2025-03 | Taiwan, Japan | Government, Public institutions | Trend Micro (2025-04-30) — Earth Kasha is MirrorFace (MITRE G1054) |
| Operation AkaiRyū — Expo 2025 lure against a Central European diplomatic institute, ANEL revival | 2024-06 – 2024-09 | Central Europe, Japan | Diplomatic, Research | ESET Research (2025-03-18) |
| Campaigns against Japanese government, politicians, think tanks and technology firms (NPA/NISC) | 2019-12 – 2025-01 | Japan | Government, Politics, Think Tanks, Media, Aerospace, Semiconductors | Japan NPA / NISC advisory (2025-01-08) — "from around 2019 to the present": ongoing at publication |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1204.002Malicious File |
| Stealth3 | T1564.006Run Virtual InstanceT1574.001DLLT1036.008Masquerade File Type |
| Defense Impairment2 | T1556.002Password Filter DLLT1686.003Windows Host Firewall |
| Discovery1 | T1614.001System Language Discovery |
| Exfiltration1 | T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol |
| Command and Control1 | T1071.002File Transfer Protocols |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| LODEINFO | Backdoor | Windows |
| NOOPDOOR | Backdoor | Windows |
| HiddenFace | Modular backdoor | Windows |
| ANEL (UPPERCUT) | Backdoor | Windows |
| ROAMINGMOUSE | Dropper | Windows |
| MirrorStealer | Credential stealer | Windows |
Infrastructure patterns
- Actor-created OneDrive accounts host the ZIP/LNK payloads linked from its spearphishing (ESET, 2025)
- AsyncRAT C&C reached through a Tor client the malware downloads, on a .onion address (ESET, 2025)
Reporting and advisories 4
- MITRE ATT&CK
MirrorFace (G1054) group profile - Japan National Police Agency / NISC
MirrorFaceによるサイバー攻撃について（注意喚起） — MirrorFace advisory (8 Jan 2025) - ESET Research
Operation AkaiRyū — Expo 2025 lure against a Central European diplomatic institute, ANEL revival - Trend Micro
Earth Kasha spear-phishing of Taiwan and Japan government — ROAMINGMOUSE → ANEL / NOOPDOOR