JPCERT/CCPDF
PowerPoint Presentation
Excerpt
Unmasking HiddenFace
MirrorFace’s most complex backdoor yet
Dominik Breitenbacher
Malware Researcher
Unmasking NOOPDOOR
MirrorFace’s most complex backdoor yet
Dominik Breitenbacher
Malware Researcher
Dominik Breitenbacher
• Malware researcher @ ESET since 2019
• Research focus
• MirrorFace – LODEINFO
• Kimsuky
dominik.breitenbacher@eset.com @dbreitenbacher dbreitenbacher Agenda
MirrorFace overview
HiddenFace (NOOPDOOR)
▪ Introduction
▪ Execution chain
▪ Technical details
MirrorFace
MirrorFace
China-aligned threat actor
Active at least since 2019
▪ Activity often attributed to APT10
LODEINFO malware unique for the group
Exclusively targeting Japanese entities (?)
Victimology
Media Defense-related
companies
Think tanks
Political entities Academic institutes
Hi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by JPCERT/CC on jsac.jpcert.or.jp.
Mentioned in the excerpt
More from JPCERT/CC6
- JSAC2026_1_3_joseph_chen_en.pdfJPCERT/CC · Added 10 Oct
- Malware “TSCookie”JPCERT/CC · Published 5 Mar 2018
- JSAC2025_2_9_kamekawa_sasada_niwa_en.pdfJPCERT/CC · Added 14 Nov 2025
- JSAC2025_1_5_leon-chang_theo-chen_en.pdfJPCERT/CC · Added 27 Jan 2025
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
