Threat Actor 🇨🇳 China

MirrorFace

Also known as: Earth Kasha

MirrorFace is a Chinese-speaking advanced persistent threat group that has been targeting high-value organizations in Japan, including media, government, diplomatic, and political entities. They have been conducting spear-phishing campaigns, utilizing malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive data. While there is speculation about their connection to APT10, ESET currently track them as a separate entity.

Indicators of Compromise 10

Domain mail[.]io Domain openmail[.]pro Domain tutamail[.]com Filename /bin/fgfm Filename attacker-cert3 Filename backdoor-ssh Filename helpdesk IP 1[.]2[.]3[.]4 IP 144[.]31[.]1[.]252 IP 8[.]8[.]8[.]8

MITRE ATT&CK TTPs 10

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078.002
Domain Accounts
Defense Evasion
 T1098.002
Additional Email Delegate Permissions
Persistence
 T1110.001
Password Guessing
Credential Access
 T1136.001
Local Account
Persistence
 T1543.001
Launch Agent
Persistence
 T1556.004
Network Device Authentication
Credential Access
 T1566
Phishing
Initial Access

Source Articles

Opening the Black Box: Agentless Threat Detection for Virtual Appliances
FortiGate virtual appliances are being actively targeted by multiple threat actors due to their internet-facing nature and elevated privileges. Attackers exploit vulnerabilities such as CVE-2026-24858, CVE-2024-55591, and CVE-2022-41328 to gain access, create backdoor accounts, manipulate certificates, and establish lateral movement. These activities are often obscured by log deletion and weak configurations, making detection difficult without agentless visibility.
wiz