Procedure examples

During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.

During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.

During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.

During Operation AkaiRyū, MirrorFace used PowerShell in execution chains to drop additional files such as embedded CAB files.

During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.

During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.

During Operation AkaiRyū, MirrorFace deleted delivered tools and files from compromised hosts.

During Operation AkaiRyū, MirrorFace collected system information.

During Operation AkaiRyū, MirrorFace enumerated file system details in compromised environments.

During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.

During Operation AkaiRyū, MirrorFace loaded malicious Word templates containing VBA code leading to installation of UPPERCUT.

During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.

During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments.

During Operation AkaiRyū, MirrorFace exported Chrome web data including contact information, keywords, autofill data, and stored credit card information.

During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY.

During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.

During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.

During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.

During Operation AkaiRyū, MirrorFace sent spearphishing emails with malicious OneDrive links.

During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.

During Operation AkaiRyū, MirrorFace established OneDrive accounts to host malicious payloads.

During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.

During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.

During Operation AkaiRyū, MirrorFace deployed multiple publicly available tools including PuTTY, FRP, and Rubeus.

During Operation AkaiRyū, MirrorFace used links to direct victims to malicious files hosted on OneDrive.

During Operation AkaiRyū, MirrorFace cleared Windows event logs post compromise.