ESET MirrorFace 2025

AsyncRAT can enumerate the NetBIOS name on targeted machines.

During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.

During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.

During Operation AkaiRyū, MirrorFace used PowerShell in execution chains to drop additional files such as embedded CAB files.

AsyncRAT can be deployed via batch script.

During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.

During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.

During Operation AkaiRyū, MirrorFace deleted delivered tools and files from compromised hosts.

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.

AsyncRAT can proxy C2 through a Tor client.

AsyncRAT has the ability to download files including over SFTP.

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

AsyncRAT can check whether the current system hour and day of the week are within operating hours defined it its configuration.

During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.

During Operation AkaiRyū, MirrorFace loaded malicious Word templates containing VBA code leading to installation of UPPERCUT.

During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.

During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments.

During Operation AkaiRyū, MirrorFace exported Chrome web data including contact information, keywords, autofill data, and stored credit card information.

During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY.

During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.

During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.

During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.

AsyncRAT use a DGA to generate a C2 domains.

UPPERCUT has been sideloaded through a legitimately signed application from the JustSystems Corporation.

During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.

During Operation AkaiRyū, MirrorFace established OneDrive accounts to host malicious payloads.

During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.

During Operation AkaiRyū, MirrorFace deployed multiple publicly available tools including PuTTY, FRP, and Rubeus.

During Operation AkaiRyū, MirrorFace used links to direct victims to malicious files hosted on OneDrive.

During Operation AkaiRyū, MirrorFace cleared Windows event logs post compromise.