LODEINFO
Software · ATTACK:enterprise:S9020
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9020",
"title": "LODEINFO",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9020",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--7908f855-5b5b-4d6a-acbc-af6b45ec27ad",
"external_id": "S9020",
"domain": "enterprise",
"created": "2026-04-17T14:45:26.266Z",
"modified": "2026-05-12T15:12:00.735Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET MirrorFace DEC 2022",
"url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
},
{
"source_name": "Kaspersky LODEINFO OCT 2022",
"url": "https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"
},
{
"source_name": "ITOCHU LODEINFO JAN 2024",
"url": "https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00c1536c-5f37-4f45-a8ae-c426325d24e5
ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07e77aac-6518-41d9-9330-7df48651933b
Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1401b773-6718-480c-aa8f-72020637d65a
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18fbf9cb-5008-4701-99de-11cfa35978df
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d5e1f26-2a73-4709-bd56-ddfae14f48b9
Kaspersky LODEINFO OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23a9b432-2d25-45a7-b75f-7496b26702f8
ESET MirrorFace DEC 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30a4c248-9477-4eba-8925-f559682b0a1f
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--390d98f6-dd1c-4fce-a02a-4ac2c1d30934
ESET MirrorFace DEC 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--392dbbcb-92e8-4ccc-8b1d-73c8577fc487
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ba83641-d086-4a15-8465-33d8caa98c6a
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f6981d7-5647-41ca-99af-180f8ece72f1
Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--463d9d77-abae-4848-aac4-bd4163318b8c
ESET MirrorFace DEC 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--602eff7d-5d1c-4023-9fae-a4125df43461
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61162be6-8e6d-4a0c-8334-079161389b0d
Kaspersky LODEINFO OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6249eaef-c1bd-4c5f-945c-ce6df3248147
ESET MirrorFace DEC 2022 · ITOCHU LODEINFO JAN 2024 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63893202-b877-4ada-9844-dda729fc9b16
ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65c7d5b3-fc9c-4b34-a519-ac8b3eef159a
Kaspersky LODEINFO OCT 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S9020
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cceaffa-6408-43f9-b090-96360c5635dc
Kaspersky LODEINFO OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6dbdaa06-8c0c-4b74-8274-1adbd80d0940
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--748d3716-e476-4677-979b-cb4c51c598c1
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--78d2ca9f-3aed-46c9-be3e-b5ee1f4bd648
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81b91e10-b98a-4064-995b-b48aa8ccc897
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83b6ef41-24e7-4ace-bb6e-29faf8ac5ab4
Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9305bc36-68ab-4354-bfa4-6834e028b258
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95615d72-da27-42f5-b7a3-a2651ca68a2a
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--973856a0-43cf-49c7-9322-a7203834464c
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a270f349-15fd-4130-8b25-a8771debb0f1
Kaspersky LODEINFO OCT 2022ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4261771-7a46-4203-b861-81566d36ad4e
ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c28ef21a-d62b-45de-8cda-e80f0cb3accf
ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca5fef73-8710-4c03-a9ea-2012d6287cae
ESET MirrorFace DEC 2022 · ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf5301fc-fc68-42ff-828f-280c8d0ed19f
ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddac1aee-5aca-4ccb-bba4-52a2b52e2abc
ITOCHU LODEINFO JAN 2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef10f1da-2388-4404-97aa-bcfa9bcd27ec
ESET MirrorFace DEC 2022