Search/HiddenFace
● Malware

HiddenFace

HiddenFace is a modular backdoor developed and used exclusively by MirrorFace since at least 2021. HiddenFace can communicate both actively and passively and has been used against political and academic targets.

View graph Watch Export
Indicators tracked
0
Intelligence Reports40
40 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
26 relationships
T1053.005: Scheduled Task
source
T1033: System Owner/User Discovery
source
T1027.013: Encrypted/Encoded File
source
T1568.002: Domain Generation Algorithms
source
T1573.001: Symmetric Cryptography
source
T1686.003: Windows Host Firewall
source
T1082: System Information Discovery
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1055: Process Injection
source
T1070.006: Timestomp
source
T1480.002: Mutual Exclusion
source
T1497.003: Time Based Checks
source
T1572: Protocol Tunneling
source
T1112: Modify Registry
source
T1480: Execution Guardrails
source
T1057: Process Discovery
source
T1571: Non-Standard Port
source
T1573.002: Asymmetric Cryptography
source
T1095: Non-Application Layer Protocol
source
T1518.001: Security Software Discovery
source
T1105: Ingress Tool Transfer
source
T1027.007: Dynamic API Resolution
source
T1008: Fallback Channels
source
T1090.001: Internal Proxy
source