MirrorFace Strikes Again: Chinese Hackers Target Europe with Expo 2025 Lure!
MirrorFace, a Chinese APT actor and APT10 subgroup, has expanded its focus beyond Japan, targeting a Central European diplomatic institute in a campaign called Operation AkaiRyū. Using a mix of backdoors like Anel and HiddenFace, MirrorFace infiltrates systems with spearphishing emails, all while keeping a close watch on the upcoming Expo 2025.
Hot Take:
MirrorFace seems to be channeling their inner James Bond villain by targeting diplomatic institutes, and they’ve got all the cool gadgets, too! Who knew state-sponsored cyber espionage could be so… trendy?
Key Points:
- MirrorFace, aka Earth Kasha, is targeting a Central European diplomatic institute in relation to Expo 2025.
- The group is linked to the Chinese state-sponsored hacking group APT10.
- New tactics and tools, including the Anel backdoor and customized AsyncRAT, have been observed.
- MirrorFace’s campaign, Operation AkaiRyū, is their first known attack on a European entity.
- Despite broader targeting, the focus remains on Japanese-related events.
Already a member? Log in here