MalwareEnterprise
S9021: DOWNIISSA
DOWNIISSA is a shellcode downloader that has been used by MirrorFace since at least 2022 to deploy payloads, including the LODEINFO backdoor.[1]
Windows
MITRE ATT&CK® Reference
Software
Malware and tool entries linked to techniques, groups, and campaigns.
3 records · validated library
Software results
Results are validated against normalized ATT&CK source records when available; sample records are used only in development or empty-data environments.
MalwareEnterprise
S9020: LODEINFO
LODEINFO is a fileless backdoor malware first identified in 2020 that has been used by actors including MirrorFace, primarily against media, diplomatic, governmental, and public sector organizations in Japan.[1][2][3]
Windows
MalwareEnterprise
S9022: MirrorStealer
MirrorStealer is a credential stealer that has been used by MirrorFace since at least 2022 to steal credentials from various applications, including browsers and email clients. MirrorStealer has been delivered directly into system memory via commands issued by LODEINFO.[1]
Windows
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.