MirrorStealer
Software · ATTACK:enterprise:S9022
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S9022",
"title": "MirrorStealer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S9022",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--2f851d4a-18cc-4d7f-9408-b10ef02ee936",
"external_id": "S9022",
"domain": "enterprise",
"created": "2026-04-17T16:54:17.773Z",
"modified": "2026-04-24T02:32:16.653Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET MirrorFace DEC 2022",
"url": "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"
}
]
}Explicit source assertions (5)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--065810ad-cd56-401a-a19b-94dc302ed8e2
ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S9022
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ef43f4a-6781-4e70-a09c-368283ab411c
ESET MirrorFace DEC 2022ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1552.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39d06f63-a10e-4882-91f0-7f96a6ad74e8
Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95ebe979-ec88-489d-ba9d-b4ac2f1f22db
ESET MirrorFace DEC 2022ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--976118d5-b033-4dfc-b4be-b8190f2cf641
ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha NOV 2024