Quick links
Press Enter to search, Esc to close
Threat group profile
Japan's National Police Agency (NPA) and NISC (8 January 2025) describe MirrorFace (also called Earth Kasha) as an organized group with suspected Chinese involvement.
In short
Japan's National Police Agency (NPA) and NISC (8 January 2025) describe MirrorFace (also called Earth Kasha) as an organized group with suspected Chinese involvement. It is reported to target Japanese think tanks, government, politicians, media, academia, and semiconductor, manufacturing and aerospace firms. It uses phishing emails and flaws in internet-facing devices to steal information on national security and advanced technology.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| MirrorFace | MITRE ATT&CK G1054 (group name); NPA and NISC alert of 8 January 2025[1, 3] |
| Earth Kasha | MITRE ATT&CK (Associated Groups); NPA and NISC alert ("also known as")[1, 3] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
Japan National Police Agency (NPA) and NISC 8 January 2025
Assessed that campaigns against organizations, businesses and individuals in Japan from about 2019 to the present were carried out by MirrorFace. Said it is also known as Earth Kasha.[2, 3]
Japan National Police Agency (NPA) and NISC 8 January 2025
Assessed the campaigns as a series of organized cyberattack activities with suspected Chinese involvement. Said they were mainly aimed at stealing information on national security and advanced technology.[2, 3]
NPA Security Bureau (Focus report) 2025
Restated that NPA and NISC assessed MirrorFace campaigns since around 2019 as organized cyberattacks with suspected Chinese involvement.[5]
NISC and the Cybersecurity Strategic Headquarters 27 June 2025
Annual report 2025 lists MirrorFace, "suspected of Chinese involvement", among the main domestic incidents of fiscal 2024. It dates the campaign from December 2019.[6]
Japan Cybersecurity Strategy 23 December 2025
Said that since 2019 the group MirrorFace has been running campaigns aimed at theft of information on Japan's national security and advanced technologies. Said the group is suspected of involvement by China.[7]
NPA Cyber Affairs Bureau March 2026
Report on 2025 repeats that NPA and NISC assessed MirrorFace attacks as organized activity likely involving China.[8]
MITRE ATT&CK page last modified 31 July 2026
Describes MirrorFace as a PRC-aligned cyberespionage actor, active since at least 2019. Says it is believed to be a subgroup under the menuPass umbrella based on targeting, tools and infrastructure overlaps.[1]
Sources differ on how far attribution goes. NPA and NISC say "suspected Chinese involvement" and name no unit or people. MITRE calls the group PRC-aligned and believed to be a subgroup under the menuPass umbrella. The NPA and NISC alert does not mention this.
On the start date, MITRE says active "since at least 2019". The NPA alert says "around 2019". The NISC annual report says from about December 2019.
On geography, MITRE lists Central Europe targets, while the NPA and NISC alert covers Japan only. MITRE's page also lists Operation AkaiRyu with 2004 dates. These do not fit the 2019 start and are not used here.
Each entry is attributed to the group by the sources cited.
MITRE says the group has been active since at least 2019.[1]
NPA says intrusions probably came through VPN device flaws or stolen credentials, and a SQL injection flaw on public servers. They were mainly against Japan's semiconductor, manufacturing, telecom, academia and aerospace sectors.[2]
NPA says the Windows Sandbox technique was probably used from around June 2023 at the latest.[2]
NPA and NISC say they confirmed attacks exploiting internet-facing device flaws since around 2023.[3]
NPA reports compromise linked to campaign B continuing until around January and June 2024.[2]
NPA reports compromise linked to campaign A infections continuing until around May 2024.[2]
NPA and NISC say emails with download links and the ANEL malware have been confirmed since around June 2024.[3]
NPA says the VS Code remote tunnel technique had been seen since June 2024 at the latest.[4]
Lists MirrorFace among the main domestic cyber incidents of fiscal 2024.[6]
Japan's strategy describes MirrorFace as running campaigns since 2019, suspected of involvement by China.[7]
NPA's report on 2025 repeats the January 2025 alert.[8]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 8 January 2025 | NPA and NISC | Joint alertPublished the three campaigns, the malware used, vulnerable device types, and detection and mitigation advice.[2, 3] |
| 8 January 2025 | NPA | Technical annexesPublished two annexes on the Windows Sandbox and VS Code techniques with traces and detection tips.[4] |
| 2025 | NPA Security Bureau | Focus reportIncluded MirrorFace as a case study in the cyber situation chapter.[5] |
| 27 June 2025 | NISC | Annual reportListed the January 2025 alert among its actions for fiscal 2024.[6] |
| 23 December 2025 | Japan government | Cybersecurity StrategyCited the January 2025 advisory as the source on MirrorFace.[7] |
| March 2026 | NPA Cyber Affairs Bureau | Annual threat reportCited the alert as an example of information sharing with partners.[8] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
Emails with Word, Excel, VHD or ISO attachments that ask the reader to enable macros. Senders pose as known experts or former executives.[1, 2]
Phishing: Spearphishing Link T1566.002
Emails with links, including OneDrive links, to download malware, used in campaign C.[1, 2, 3]
Exploit Public-Facing Application T1190
Exploited flaws in internet-facing devices such as Array AG, FortiOS and Citrix ADC in campaign B.[1, 2]
Hijack Execution Flow: DLL T1574.001
Used legitimate executables to load malicious DLLs by sideloading.[1]
Masquerading: Masquerade File Type T1036.008
Made malware payloads look like Privacy-Enhanced Mail (PEM) files.[1]
Indicator Removal: File Deletion T1070.004
Deleted directories holding malware and archives of collected files.[1]
LODEINFO Backdoor
Fileless backdoor first identified in 2020, used in campaign A and campaign B.[1, 2]
HiddenFace (also NOOPDOOR) Modular backdoor
MITRE says it is used exclusively by MirrorFace since at least 2021. NPA names NOOPDOOR in all three campaigns.[2]
UPPERCUT (ANEL) Backdoor
Backdoor also used by menuPass. NPA names ANEL as the malware of campaign C.[3]
MirrorStealer Credential stealer
Steals credentials from browsers and email clients, delivered into memory by LODEINFO (per MITRE ATT&CK).
NOOPLDR Loader
Shellcode loader used to load HiddenFace (per MITRE ATT&CK).
DOWNIISSA Downloader
Shellcode downloader used to deploy payloads including LODEINFO (per MITRE ATT&CK).
ROAMINGHOUSE Dropper
Extracts and runs embedded payloads including UPPERCUT components (per MITRE ATT&CK).
ANELLDR Loader
Loader designed to decrypt and run UPPERCUT in memory (per MITRE ATT&CK).
Cobalt Strike Attack framework
Named by MITRE for persistence and by NPA (as Cobalt Strike BEACON) in campaign B.[1, 2]
LilimRAT Remote access tool
NPA says some campaign A victims were also infected with LilimRAT and NOOPDOOR.[2]
Neo-reGeorg Tunnelling tool
NPA says it was placed on compromised VPN devices together with open-source web shells.[2]
Windows Sandbox and VS Code (abused) Built-in tools
NPA says malware ran inside Windows Sandbox to avoid host monitoring. It says VS Code tunnels gave remote control.[2, 3, 4]
Follow alerts from NPA, IPA, JPCERT/CC and the CISA KEV list for VPN and gateway devices. Patch quickly.
Counters T1190
NPA says a device that was once compromised may keep its backdoor after patching, so replace it.
Counters T1190
Consider turning off Windows Sandbox if not needed. Look for unexpected VS Code installs or dev tunnel traffic.
Counters T1219.001
See which VPN, gateway and other internet-facing devices you expose. These are the device types NPA says were used for entry.
Spot look-alike domains and fake sender setups aimed at your staff. The campaigns rely on convincing emails.
Watch for leaked or sold company credentials. NPA says some intrusions used credentials obtained by some means.
Follow what NPA, NISC and MITRE report about this group and compare it with your own controls.
Japan's NPA and NISC attribute campaigns against Japanese organizations since about 2019 to MirrorFace, also known as Earth Kasha. They assess them as organized activity with suspected Chinese involvement. MITRE says it is believed to be a subgroup under the menuPass umbrella.
The latest government items found are the NPA and NISC alert of 8 January 2025 and the December 2025 Cybersecurity Strategy. The alert describes campaign C as running since around June 2024. The Strategy describes the group in the present tense.
NPA and NISC name think tanks, government, politicians, media, academia, and the semiconductor, manufacturing, telecommunications and aerospace sectors in Japan. MITRE adds Central Europe.
Phishing emails with attachments or download links, and flaws in VPN and gateway devices, according to NPA, NISC and MITRE.
If you work in Japan's government, media, think tank, academia or technology sectors, check your device patches and logs first. Do the same if you run the VPN and gateway devices NPA names.
Patch and monitor VPN and gateway devices and keep logs in one place. Treat enable-content prompts and unexpected links as suspect. Report anything odd to the police or NISC.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
