MirrorFace

Names and who uses them

• MirrorFaceOur name
• Earth KashaTrend Micro

Targets

Sectors: Defence, Finance, Education, Manufacturing, Media, Diplomatic

Regions: Europe, Japan

Known techniques

• T1003.001LSASS Memory
• T1003.002Security Account Manager
• T1003.003NTDS
• T1005Data from Local System
• T1007System Service Discovery
• T1016System Network Configuration Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1027.013Encrypted/Encoded File
• T1033System Owner/User Discovery
• T1036.008Masquerade File Type
• T1047Windows Management Instrumentation
• T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
• T1057Process Discovery
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1070.004File Deletion
• T1071.002File Transfer Protocols
• T1074.002Remote Data Staging
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087.002Domain Account
• T1090Proxy
• T1114.001Local Email Collection
• T1190Exploit Public-Facing Application
• T1204.002Malicious File
• T1221Template Injection
• T1482Domain Trust Discovery
• T1553.002Code Signing
• T1556.002Password Filter DLL
• T1560.001Archive via Utility
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1574.001DLL
• T1587.001Malware
• T1588.002Tool
• T1591Gather Victim Org Information
• T1614.001System Language Discovery
• T1684.001Impersonation

Malware and tools used