HiddenFace

MITRE ATT&CK: S9023 View on attack.mitre.org

Aliases: NOOPDOOR, HiddenFace

First seen
2021-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:09:11

Targeted industries: education-and-nonprofits government-and-public-sector

Targeted regions: country_code:jp

Context

HiddenFace is a modular backdoor developed and used exclusively by MirrorFace since at least 2021. HiddenFace can communicate both actively and passively and has been used against political and academic targets.

Detection coverage

  • 368 Sigma rules

Malware & tools used

  • Scheduled Task (attack-pattern)
  • Non-Standard Port (attack-pattern)
  • Asymmetric Cryptography (attack-pattern)
  • Internal Proxy (attack-pattern)
  • Encrypted/Encoded File (attack-pattern)
  • Mutual Exclusion (attack-pattern)
  • Non-Application Layer Protocol (attack-pattern)
  • Time Based Checks (attack-pattern)
  • Fallback Channels (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Data from Local System (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Dynamic API Resolution (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Timestomp (attack-pattern)
  • Domain Generation Algorithms (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Process Discovery (attack-pattern)
  • Process Injection (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • Protocol Tunneling (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Modify Registry (attack-pattern)
  • Execution Guardrails (attack-pattern)
  • Windows Host Firewall (attack-pattern)

Used by threat actors

  • Operation AkaiRyū (campaign)
  • MirrorFace (threat-actor)

Reports & references

  • Trend Micro — Lodeinfo Campaign Of Earth Kasha (report)
  • blogs.jpcert.or.jp — Mirrorface Attack Against Japanese Organisations (report)
  • Trend Micro — Earth Kasha Updates Ttps (report)
  • jsac.jpcert.or.jp — Jsac2024 2 7 Hara Shoji Higashi Vickie Su Nick Dai En (report)
  • macnica.co.jp — Cyberespionage Report 2023 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Noopdoor (report)
  • MITRE ATT&CK — S9023 (report)
  • jsac.jpcert.or.jp — Jsac2024 2 8 Breitenbacher En (report)

External references