LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G1054: MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]

EnterpriseG1054GroupObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

MirrorFace is an ATT&CK group entry for a PRC-aligned cyberespionage actor, also known as Earth Kasha, associated with Japanese-sector targeting and later activity involving Central Europe. For leaders, the practical issue is not a single malware name; it is whether the organization can recognize espionage-style intrusion behavior that blends custom backdoors with normal Windows administration utilities and credential access activity.

Executive priority

Prioritize this as a readiness and exposure question for organizations with relevant regional, government, media, defense, diplomatic, financial, manufacturing, academic, or public-sector ties. Executives should ask whether SOC, identity, endpoint, and incident response teams can produce evidence for credential theft attempts, domain discovery, suspicious Windows utility use, and malware/backdoor activity tied to the related ATT&CK software. This object is also useful for audit and board reporting because it maps strategic threat intelligence to concrete control validation areas rather than relying on actor naming alone.

Technical view

ATT&CK provides no group-level detection text, no group-level tactics, and no group-level platforms, so defenders should pivot from the relationships. MirrorFace is linked to Windows-heavy tooling and behaviors including LODEINFO, HiddenFace, UPPERCUT, DOWNIISSA, MirrorStealer, NOOPLDR, ROAMINGHOUSE, Cobalt Strike, BITSAdmin, Net, Tasklist, Ping, ipconfig, nbtstat, Nltest, and Wevtutil. Related techniques include credential access against LSASS, SAM, and NTDS; discovery of services, network configuration, and remote systems; and collection from local systems. Validate whether detections connect these behaviors into intrusion narratives instead of treating each command-line utility as isolated administrative noise.

Likely telemetry

  • Endpoint process creation and command-line telemetry for Windows utilities such as net, tasklist, ping, ipconfig, nbtstat, nltest, wevtutil, and bitsadmin
  • Endpoint security alerts and file/memory indicators for related malware families: LODEINFO, HiddenFace, UPPERCUT, DOWNIISSA, MirrorStealer, NOOPLDR, and ROAMINGHOUSE
  • Credential access evidence involving LSASS access, SAM access, and NTDS.dit access or copying
  • Windows event logs and EDR telemetry from domain controllers, administrator workstations, and high-value endpoints
  • Network telemetry for unusual HTTP-based backdoor communications, remote access tooling, and internal discovery patterns

Detection direction

  • Do not rely on actor-name detections; validate behavior-based analytics for credential dumping, domain discovery, service discovery, local data collection, and suspicious use of built-in administration tools.
  • Tune detections for context: utilities such as net, ping, ipconfig, tasklist, nbtstat, nltest, wevtutil, and bitsadmin have legitimate administrative use, so prioritize unusual parent processes, rare hosts, unusual users, sequencing, and execution on sensitive systems.
  • Correlate malware alerts with discovery and credential-access telemetry. MirrorFace relationships include both custom malware and normal operating-system utilities, so single-signal detections may miss the broader intrusion pattern.
  • Confirm visibility on domain controllers and systems likely to hold sensitive credentials or data, since related techniques include LSASS Memory, SAM, and NTDS.
  • Review coverage for Operation AkaiRyū as campaign context where relevant, while avoiding assumptions that the campaign applies to the local environment without supporting evidence.

Mitigation priorities

  • Harden credential stores and privileged access first: reduce standing administrative access, protect LSASS where feasible, monitor domain controllers, and restrict access to NTDS and backups.
  • Improve endpoint and command-line logging coverage before relying on detections for living-off-the-land utilities.
  • Restrict and monitor high-risk administrative tooling such as BITSAdmin and remote administration utilities according to business need.
  • Segment and monitor high-value systems that align with espionage collection risk, including government, diplomatic, research, financial, manufacturing, media, and public-sector data environments where applicable.
  • Prepare incident response playbooks for suspected credential theft and backdoor activity, including containment of privileged accounts, domain controller review, and scoping across endpoints and identity systems.
Additional notes and limits

The decision value of this object is in its relationships: MirrorFace is associated with custom malware, Cobalt Strike, credential theft techniques, discovery techniques, and common Windows utilities. This supports purple-team and detection-engineering validation around intrusion chains rather than isolated indicators. The official description notes alignment, targeting history, aliases, and malware use, but local risk should be determined by business geography, sector, partner exposure, and telemetry maturity.

ATT&CK does not provide official detection guidance, group-level tactics, or group-level platforms for this object. Several platform details come from related software and technique objects, not from the group object itself. The supplied relationship excerpt for Operation AkaiRyū is truncated. This summary should not be read as evidence of active exploitation or confirmed exposure in any specific environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

43 rows
DomainIDNameRelationship / procedure
EnterpriseT1566.002Spearphishing LinkSub-technique

MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.[6]

EnterpriseT1057Process Discovery

MirrorFace has used Tasklist on compromised hosts for discovery.[4]

EnterpriseT1686.003Windows Host FirewallSub-technique

MirrorFace can modify the system firewall to allow communication to certain ports.[4]

EnterpriseT1074.002Remote Data StagingSub-technique

MirrorFace has gathered data and files of interest on a single victim machine.[5]

EnterpriseT1685Disable or Modify Tools

MirrorFace has disabled Windows Defender in compromised environments.[4]

EnterpriseT1087.002Domain AccountSub-technique

MirrorFace has used native Windows tools to obtain domain user information.[5]

EnterpriseT1614.001System Language DiscoverySub-technique

MirrorFace has deployed shellcode to check for Japanese Microsoft Office settings.[7]

EnterpriseT1591Gather Victim Org Information

MirrorFace has placed specific content in phishing emails to target members of particular political parties.[3]

EnterpriseT1090Proxy

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.[4]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

MirrorFace has deleted Windows event logs.[4]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

MirrorFace has used RDP to exfiltrate files of interest.[5]

EnterpriseT1587.001MalwareSub-technique

MirrorFace has created and continued to develop custom strains of malware including LODEINFO.[3]

EnterpriseT1070.004File DeletionSub-technique

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.[3][5][6][4]

EnterpriseT1003.002Security Account ManagerSub-technique

MirrorFace has used vssadmin to copy registry hives including SAM.[5][4]

EnterpriseT1083File and Directory Discovery

MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.[3][5][4]

EnterpriseT1482Domain Trust Discovery

MirrorFace has run `nltest.exe /domain_trusts` on compromised systems to discover domain relationships.[5]

EnterpriseT1684.001ImpersonationSub-technique

MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.[3]

EnterpriseT1588.002ToolSub-technique

MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.[3][5][4]

EnterpriseT1003.001LSASS MemorySub-technique

MirrorFace has dumped LSASS memory for credential access.[4]

EnterpriseT1204.002Malicious FileSub-technique

MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.[1][3][7][6]

EnterpriseT1018Remote System Discovery

MirrorFace has used Ping for system discovery.[4]

EnterpriseT1016System Network Configuration Discovery

MirrorFace has used ipconfig for reconnaissance.[4]

EnterpriseT1553.002Code SigningSub-technique

MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.[3]

EnterpriseT1005Data from Local System

MirrorFace gathered data and files of interest from victim's systems.[5]

EnterpriseT1059.003Windows Command ShellSub-technique

MirrorFace has used `cmd.exe` for malware execution, file discovery, and manual file manipulation.[5][6][4][4]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.[1][3][7]

EnterpriseT1059.005Visual BasicSub-technique

MirrorFace has used remote templates with VBA code in malware infection chains.[7]

EnterpriseT1007System Service Discovery

MirrorFace has used Tasklist for discovery post compromise.[4]

EnterpriseT1082System Information Discovery

MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.[7][5][4]

EnterpriseT1048.002Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolSub-technique

MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.[4]

EnterpriseT1574.001DLLSub-technique

MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.[1][3][7][5]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

MirrorFace has used SMB to copy malware between systems in compromised environments.[5][4]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

MirrorFace has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.[3]

EnterpriseT1190Exploit Public-Facing Application

MirrorFace has exploited vulnerabilities in Fortigate and Array AG devices for initial access.[4]

EnterpriseT1036.008Masquerade File TypeSub-technique

MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.[7]

EnterpriseT1003.003NTDSSub-technique

MirrorFace has dumped NTDS.dit through volume shadow copies.[5][4]

EnterpriseT1560.001Archive via UtilitySub-technique

MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.[3][5][4]

EnterpriseT1221Template Injection

MirrorFace has used remote template injection to retrieve malicious payloads from the C2.[7]

EnterpriseT1556.002Password Filter DLLSub-technique

MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.[3]

EnterpriseT1047Windows Management Instrumentation

MirrorFace has leveraged WMIC on targeted systems post compromise.[4]

EnterpriseT1114.001Local Email CollectionSub-technique

MirrorFace has exfiltrated stored emails from compromised hosts.[3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.[7]

EnterpriseT1033System Owner/User Discovery

MirrorFace has used Windows native tools to enumerate user information.[5]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
MalwareEnterprise

S0154: Cobalt Strike

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]

LinuxmacOSWindows
ToolEnterprise

S0359: Nltest

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

Windows
ToolEnterprise

S0057: Tasklist

The Tasklist utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. [1]

ToolEnterprise

S0100: ipconfig

ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. [1]

MalwareEnterprise

S9020: LODEINFO

LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]

Windows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · ToolS0039: NetEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · MalwareS0154: Cobalt StrikeEnterpriseuses · MalwareS9022: MirrorStealerEnterpriseuses · TechniqueT1686.003: Windows Host FirewallEnterpriseuses · MalwareS0275: UPPERCUTEnterpriseuses · TechniqueT1074.002: Remote Data StagingEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1614.001: System Language DiscoveryEnterpriseattributed to · CampaignC0060: Operation AkaiRyūEnterpriseuses · ToolS0359: NltestEnterpriseuses · TechniqueT1591: Gather Victim Org InformationEnterpriseuses · ToolS0190: BITSAdminEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · ToolS0057: TasklistEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1587.001: MalwareEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1482: Domain Trust DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
00c579b3156fa650...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundle00c579b3156f…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  2. [2]
    Kaspersky LODEINFO Part II OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.

    Open source URL
  3. [3]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  4. [4]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  5. [5]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  6. [6]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  7. [7]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  8. [8]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  9. [9]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  10. [10]
    ESET HiddenFace 2024

    Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.

    Open source URL
  11. [11]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  12. [12]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  13. [13]
    Earth Kasha

    (Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

  14. [14]
    Earth Kasha

    (Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

  15. [15]
    Earth Kasha

    (Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

  16. [16]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  17. [17]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  18. [18]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  19. [19]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  20. [20]
    Kaspersky LODEINFO Part II OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.

    Open source URL
  21. [21]
    Kaspersky LODEINFO Part II OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.

    Open source URL
  22. [22]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  23. [23]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  24. [24]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  25. [25]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  26. [26]
    mitre-attackG1054
    Open source URL
  27. [27]
    mitre-attackG1054
    Open source URL
  28. [28]
    mitre-attackG1054
    Open source URL
  29. [29]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  30. [30]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  31. [31]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  32. [32]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  33. [33]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  34. [34]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  35. [35]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  36. [36]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  37. [37]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  38. [38]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  39. [39]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  40. [40]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  41. [41]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  42. [42]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  43. [43]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  44. [44]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  45. [45]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  46. [46]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  47. [47]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  48. [48]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  49. [49]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  50. [50]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  51. [51]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  52. [52]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  53. [53]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  54. [54]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  55. [55]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  56. [56]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  57. [57]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  58. [58]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  59. [59]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  60. [60]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  61. [61]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  62. [62]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  63. [63]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  64. [64]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  65. [65]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  66. [66]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  67. [67]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  68. [68]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  69. [69]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  70. [70]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  71. [71]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  72. [72]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  73. [73]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  74. [74]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  75. [75]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  76. [76]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  77. [77]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  78. [78]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  79. [79]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  80. [80]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  81. [81]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  82. [82]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  83. [83]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  84. [84]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  85. [85]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  86. [86]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  87. [87]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  88. [88]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  89. [89]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  90. [90]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  91. [91]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  92. [92]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  93. [93]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  94. [94]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  95. [95]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  96. [96]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  97. [97]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  98. [98]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  99. [99]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  100. [100]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  101. [101]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  102. [102]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  103. [103]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  104. [104]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  105. [105]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  106. [106]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  107. [107]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  108. [108]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  109. [109]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  110. [110]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  111. [111]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  112. [112]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  113. [113]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  114. [114]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  115. [115]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  116. [116]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  117. [117]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  118. [118]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  119. [119]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  120. [120]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  121. [121]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  122. [122]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  123. [123]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  124. [124]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  125. [125]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  126. [126]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  127. [127]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  128. [128]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  129. [129]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  130. [130]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  131. [131]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  132. [132]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  133. [133]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  134. [134]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  135. [135]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  136. [136]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  137. [137]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  138. [138]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  139. [139]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  140. [140]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  141. [141]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  142. [142]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  143. [143]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  144. [144]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  145. [145]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  146. [146]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  147. [147]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  148. [148]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  149. [149]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  150. [150]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  151. [151]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  152. [152]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  153. [153]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  154. [154]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  155. [155]
    Kaspersky LODEINFO OCT 2022

    Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.

    Open source URL
  156. [156]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  157. [157]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  158. [158]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  159. [159]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  160. [160]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  161. [161]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  162. [162]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  163. [163]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  164. [164]
    ESET HiddenFace 2024

    Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.

    Open source URL
  165. [165]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  166. [166]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  167. [167]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  168. [168]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  169. [169]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  170. [170]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  171. [171]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  172. [172]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  173. [173]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  174. [174]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  175. [175]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  176. [176]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  177. [177]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  178. [178]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  179. [179]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  180. [180]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  181. [181]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  182. [182]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  183. [183]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  184. [184]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  185. [185]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  186. [186]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  187. [187]
    ESET MirrorFace DEC 2022

    Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.

    Open source URL
  188. [188]
    ITOCHU LODEINFO JAN 2024

    ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.

    Open source URL
  189. [189]
    JPCERT MirrorFace JUL 2024

    Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.

    Open source URL
  190. [190]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
  191. [191]
    Trend Micro Earth Kasha NOV 2024

    Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use