MirrorFace
MirrorFace is a China-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 11 sectors, including Government and Technology, in 11 countries, including the United States and India. It uses 47 MITRE ATT&CK techniques and exploits 9 known CVEs.
- Earth Kasha
- Operation LiberalFace
- Operation “AkaiRyū”
- Origin
- China
- Techniques
- 47
- Exploited CVEs
- 9
- First seen
- Jan 1, 2019
- Last seen
- Sep 1, 2024
- Record updated
Who They Target.
About MirrorFace.
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.