MirrorFace Leverages ANEL and NOOPDOOR in Multi-Year Cyberattacks on Japan

Summary: Japan’s National Police Agency and NCSC have linked the threat actor MirrorFace to a persistent cyber attack campaign targeting Japanese organizations since 2019, aimed at stealing sensitive national security and technology information.

Threat Actor: MirrorFace | MirrorFace
Victim: Various Japanese organizations | Japanese organizations

Key Point :

• MirrorFace, also known as Earth Kasha, is a sub-group of APT10 with a history of targeting Japanese entities.
• The attack campaigns are categorized into three major campaigns, each targeting different sectors using various methods such as spear-phishing and exploiting known vulnerabilities.
• Recent tactics include executing malware within Windows Sandbox to evade detection by antivirus software.