MirrorFace: The China-Aligned Spies Japan Named in Public

MirrorFace (ESET’s name; tracked by Trend Micro as Earth Kasha and by MITRE ATT&CK as G1054) is a China-aligned cyber-espionage group active since at least 2019. It is widely assessed as a probable sub-cluster of the APT10 (menuPass / Stone Panda) umbrella, based on overlaps in targeting, tooling and infrastructure — a hedged link, not a confirmed identity. In January 2025 Japan’s National Police Agency and the cabinet cyber centre took the unusual step of publicly attributing a multi-year campaign to MirrorFace, raising confidence in the China-aligned assessment.

Attribution

MirrorFace is assessed as China-aligned and espionage-motivated. ESET treats it as its own cluster; Trend Micro and others describe it as believed to be a sub-cluster of APT10. Treat the APT10 relationship as probable rather than settled. The January 2025 Japanese government advisory is a government-level attribution and the strongest public signal to date.

Targeting

Historically Japanese organisations — government, defence, diplomatic, media, financial, manufacturing and academic/think-tank bodies — with a focus on national-security and advanced-technology data. Activity expanded to Taiwan in 2025 and, per ESET’s “Operation AkaiRyu” (2024), to a diplomatic target in Central Europe. The Japanese advisory reportedly cites more than 200 attacks over roughly five years (a figure relayed by trade press; treat as reported).

Notable Campaigns

• 2019–2023: spear-phishing waves delivering the LODEINFO backdoor via macro-enabled Office documents.
• 2024: campaigns delivering ANEL (UPPERCUT) and NOOPDOOR (HiddenFace); reporting describes a wave exploiting known device vulnerabilities to deploy NOOPDOOR.
• 2024 (Operation AkaiRyu): ESET documented a revived ANEL backdoor plus customised AsyncRAT against a European entity.
• March 2025: Trend Micro reported a campaign against Japanese and Taiwanese public institutions using the ROAMINGMOUSE dropper and an upgraded ANEL build with in-memory BOF execution.

Malware & Tooling

LODEINFO, ANEL (aka UPPERCUT), NOOPDOOR (aka HiddenFace), the ROAMINGMOUSE macro dropper, customised AsyncRAT, Cobalt Strike and SharpHide. The 2025 ANEL build added in-memory Beacon Object File execution; NOOPDOOR has been reported to support encrypted DNS communications.

MITRE ATT&CK Mapping

Detection & Mitigation

• Treat unexpected OneDrive/cloud links with zero trust; block and inspect macro-enabled Office files from external senders, since ROAMINGMOUSE relies on macro execution.
• Hunt for DLL side-loading around ANEL and for anomalous encrypted-DNS beaconing from NOOPDOOR; monitor for in-memory/BOF execution and SharpHide scheduled-task persistence.
• Patch internet-facing and edge devices promptly given the 2024 vulnerability-exploitation wave.