HiddenFace

ATP Sandbox Adv. Heuristics

Stats

First seen: January 2025
Last seen: September 2026

MITRE ATT&CK techniques

25 techniques across 6 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.007Dynamic API Resolution
T1055Process Injection
T1070Indicator Removal
- T1070.006Timestomp
T1140Deobfuscate/Decode Files or Information
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1480Execution Guardrails
- T1480.002Mutual Exclusion
T1497Virtualization/Sandbox Evasion
- T1497.003Time Based Checks

TA0007 Discovery

T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1005Data from Local System

TA0011 Command and Control

T1008Fallback Channels
T1090Proxy
- T1090.001Internal Proxy
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1568Dynamic Resolution
- T1568.002Domain Generation Algorithms
T1571Non-Standard Port
T1572Protocol Tunneling
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography
- T1573.001Symmetric Cryptography

TA0112 Defense Impairment

T1112Modify Registry
T1686Disable or Modify System Firewall
- T1686.003Windows Host Firewall

Associated groups

G1054MirrorFace

Associated campaigns

C0060Operation AkaiRyū

Alert name variants

Alert Name	Engine
Win64.Trojan.NoopDoor	ATP Sandbox Adv. Heuristics

Related families

Bazar InvisiMole QakBot TrickBot PlugX