Japan's National Police Agency (NPA) and the National Centre of Incident Readiness and Strategy for Cybersecurity (NISC) have officially attributed a prolonged cyberattack campaign targeting Japanese organizations and individuals since 2019 to the China-linked threat actor MirrorFace, also known as Earth Kasha.
The cyberattacks were designed to steal sensitive information related to Japan's national security and emerging technologies. MirrorFace is reportedly a subgroup of the Chinese state-sponsored hacking collective APT10, notorious for deploying malware tools such as ANEL, LODEINFO, and NOOPDOOR.
Authorities have identified three distinct phases in MirrorFace's attack operations:
- December 2019 – July 2023: Spear-phishing emails carrying malware like LODEINFO, LilimRAT, and NOOPDOOR targeted government agencies, think tanks, politicians, and media outlets.
- February – October 2023: Malware such as Cobalt Strike Beacon, LODEINFO, and NOOPDOOR was deployed through vulnerabilities in network devices to infiltrate sectors like semiconductors, aerospace, and academic institutions.
- June 2024 – Present: Phishing emails loaded with ANEL malware were sent to think tanks, political figures, and media organizations.
Sophisticated Cyberattack Techniques
MirrorFace utilized advanced methods to evade detection and maintain persistence, including:
- Windows Sandbox Deployment: Malware was executed within the Windows Sandbox, a virtualized environment that limits malware persistence by erasing data upon system reset.
- Evasion of Security Tools: This technique allowed malware to operate undetected by antivirus software.
Scale and Impact of the Cyberattacks
The NPA has connected MirrorFace to over 200 cyber incidents spanning five years. The affected sectors include:
- Government Agencies
- Defense Organizations
- Space Research Centers
- Private Enterprises in Advanced Technologies
Phishing emails often used compelling subjects like "Japan-US alliance" and "Taiwan Strait" to deceive recipients into downloading malicious attachments. Notable attacks linked to similar tactics include:
- Japan Aerospace Exploration Agency (JAXA): Targeted in a sophisticated cyberattack.
- Port of Nagoya (2023): Disrupted by a ransomware incident.
In response to these threats, the NPA issued a public warning:
“This alert aims to raise awareness among targeted organizations, businesses, and individuals about the threats they face in cyberspace by publicly disclosing the methods used in the cyber-attacks by ‘MirrorFace.’ It also seeks to encourage the implementation of appropriate security measures to prevent the expansion of damage from cyber-attacks and to avert potential harm.”
The warning underscores the need for heightened cybersecurity practices across sectors to mitigate risks from increasingly sophisticated cyber threats.
