HiddenFace

Malware & Tools · HiddenFace

· MalwareS9023 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

HiddenFace is a modular backdoor developed and used exclusively by MirrorFace since at least 2021. HiddenFace can communicate both actively and passively and has been used against political and academic targets.(Citation: JPCERT MirrorFace JUL 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: Trend Micro Earth Kasha Updates APR 2025)

Tactic Coverage

command and control (9)stealth (8)discovery (5)persistence (2)privilege escalation (2)defense impairment (2)collection (1)execution (1)

Used By (1 groups)

G1054MirrorFaceEarth Kasha

Techniques (25)

T1005Data from Local System

collection

T1008Fallback Channels

command and control

T1027.007Dynamic API Resolution

stealth

T1027.013Encrypted/Encoded File

stealth

T1033System Owner/User Discovery

discovery

T1053.005Scheduled Task

executionpersistence

References

https://attack.mitre.org/software/S9023 https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html