Introduction
From December 2019 to July 2023 [1], a series of sophisticated spear-phishing attacks targeted government bodies, think tanks [1] [2], politicians [1] [2], and media outlets [1]. These attacks were primarily orchestrated by the Chinese threat actor known as MirrorFace, a subset of APT10 [2], focusing on cyber espionage to steal national security and advanced technology information.
Description
Targeted government bodies [1], think tanks [1] [2], politicians [1] [2], and media outlets have been subjected to sophisticated spear-phishing attacks from December 2019 to July 2023, primarily orchestrated by the Chinese threat actor known as MirrorFace (or Earth Kasha), a subset of APT10 [2]. This group has focused on extensive cyber espionage operations aimed at stealing national security and advanced technology information, deploying malware such as LODEINFO [1], LilimRAT [1] [2], and NOOPDOOR [1].
From February to October 2023 [1], the focus of these attacks shifted to sectors including semiconductors, aerospace [1], and academia [1], exploiting vulnerabilities in network devices to deploy Cobalt Strike Beacon alongside the previously mentioned malware. The group has demonstrated significant technical sophistication [2], employing tactics such as Visual Studio Code remote tunnels for covert communications, utilizing Windows Sandbox to evade detection [2], and implementing advanced anti-forensic techniques to eliminate evidence [2]. Additionally, their operations have extended beyond Japan to include targets in Taiwan and India, indicating a broader regional focus [2]. Japanese authorities continue to monitor and investigate these cyber threats to safeguard national interests and critical infrastructure [2].
Conclusion
The impact of these cyber espionage activities is significant, posing threats to national security and technological advancements. Mitigation efforts by Japanese authorities and international cooperation are crucial to counteract these threats. As the threat landscape evolves, continuous monitoring and adaptive security measures will be essential to protect critical infrastructure and maintain regional stability.
References
[1] https://www.infosecurity-magazine.com/news/japan-faces-cyberattacks-china/
[2] https://clickcontrol.com/cyber-espionage/chinese-hackers-5-year-siege-mirrorfaces-sophisticated-cyber-arsenal-targets-japans-security/
