MirrorFace: The APT10 Subgroup That Perfected Its Craft on Japan Then Turned to Europe

Background

MirrorFace is a cyber-espionage group assessed to sit within the APT10 umbrella and is also tracked under the name Earth Kasha. Active since at least 2019, it operated for years with an almost exclusive focus on Japanese targets: government and political entities, think tanks, academia, media, and organisations in defence, high-tech and manufacturing. Japan’s national authorities have publicly warned about its campaigns, making it one of the clearer cases of a China-aligned group named in official Japanese attribution.

In late 2024 the group’s victimology shifted. An operation nicknamed AkaiRyu (Red Dragon) targeted a Central European diplomatic institute using lures tied to Expo 2025 in Osaka. The first widely reported case of MirrorFace reaching beyond Japan into Europe. Alongside the new target, the group revived ANEL (also called UPPERCUT), an APT10 backdoor that had been dormant since roughly 2018-2019, moving away from LODEINFO, its previous mainstay implant.

What we observed

Across recent campaigns the tradecraft is consistent and stealth-focused:

• Two ways in: primarily targeted spear-phishing that lures specific individuals into opening booby-trapped documents or links (themes have included Expo 2025 and policy/diplomatic topics), and, in Earth Kasha activity, exploitation of vulnerabilities in internet-facing enterprise products such as SSL-VPN, file-transfer and proxy appliances to gain network access.
• A side-loading loader: a component known as ANELLDR is launched via DLL side-loading, which then decrypts and loads the ANEL backdoor into memory. Reviving ANEL after years of dormancy, in place of LODEINFO, is one of the most notable recent shifts.
• A private, modular backdoor: the group also deploys HiddenFace (aka NOOPDOOR), a modular backdoor observed only in MirrorFace operations, alongside a heavily customised version of AsyncRAT for additional control.
• Living off legitimate tools: MirrorFace abuses Visual Studio Code Remote Tunnels to maintain stealthy, encrypted access to compromised machines, a technique increasingly favoured by China-aligned groups because it blends into normal developer traffic.
• Deliberate anti-forensics: operational security has become markedly tighter. The group deletes the tools and files it drops, clears Windows event logs, and has been observed running malware inside Windows Sandbox, all of which frustrate incident response and leave defenders with an incomplete picture.

MirrorFace attack chain

The chain is built for stealth: side-loading hides the loader, ANEL runs in memory, and legitimate tools carry the C2, then the group deletes tools and clears logs.

Attribution

MirrorFace is a China-aligned cyber-espionage group assessed as a subgroup within the APT10 umbrella and overlapping with the cluster tracked as Earth Kasha; the revival of the APT10-linked ANEL backdoor reinforces that lineage. Its objectives are intelligence collection aligned with state interests, national security, foreign policy and advanced technology, rather than financial gain. Attribution here rests on tooling that is largely exclusive to the group (HiddenFace/NOOPDOOR), the APT10 backdoor overlap, and consistent victimology, corroborated by multiple independent analyses and Japanese government reporting; as always with nation-state clusters, it is a high-confidence assessment rather than an absolute certainty.

Confidence: 88%.

MirrorFace spent five years perfecting one target, Japan, then pointed the same disciplined playbook at Europe, and cleaned up after itself on the way out.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Detection

Copy-ready hunting query:

# Behavioural hunts for MirrorFace / Earth Kasha tradecraft
# 1) DLL side-loading: a signed EXE loading an unexpected DLL from a writable/user path (ANELLDR pattern)
index=edr event=image_load (signed_process=true dll_path IN ("*\\Users\\*","*\\ProgramData\\*","*\\Temp\\*") dll_signed=false)
# 2) Visual Studio Code Remote Tunnel abuse (legitimate tool used for C2)
index=edr (process_name="code.exe" AND command_line="*tunnel*") OR dns_query IN ("*.tunnels.api.visualstudio.com","*.devtunnels.ms")
# 3) Office spawning loaders / script hosts (initial foothold)
index=edr parent_process IN ("winword.exe","excel.exe","outlook.exe") process_name IN ("rundll32.exe","regsvr32.exe","powershell.exe","mshta.exe")
# 4) Anti-forensics: event-log clearing and Windows Sandbox execution
index=edr (process_name="wevtutil.exe" command_line="*cl*") OR event_id=1102 OR process_name="WindowsSandbox.exe" OR process_name="WindowsSandboxClient.exe"
# 5) Edge-appliance exploitation: watch SSL-VPN / file-transfer / proxy devices for new admin accounts, webshells and anomalous auth.

Recommendations

• Patch and monitor the edge: keep internet-facing SSL-VPN, file-transfer and proxy appliances fully updated, restrict management interfaces, and alert on new accounts, webshells and anomalous logons, a primary Earth Kasha entry point.
• Harden against spear-phishing: block or sandbox risky attachments and links, enforce Mark-of-the-Web macro controls, and give government, policy, diplomatic and R&D staff targeted phishing awareness. They are the intended recipients.
• Hunt the stealth techniques: alert on DLL side-loading (signed binaries loading unsigned DLLs from user-writable paths), on Visual Studio Code Remote Tunnel activity that is not from your developers, and on Office applications spawning rundll32/regsvr32/PowerShell.
• Defeat the anti-forensics: forward Windows event logs to a central SIEM in real time (the group clears local logs), alert on log-clearing (Event ID 1102) and on unexpected Windows Sandbox execution, and preserve volatile evidence early.
• Assume patience and revisit scope: MirrorFace deletes its tools after use, so a clean endpoint is not proof of eradication, hunt for persistence, lateral movement and dormant implants (HiddenFace/NOOPDOOR, ANEL) across the estate, not just the initially flagged host.