MirrorFace Strikes EU: RedDragon Operation Unleashes ANEL Malware Mayhem!
MirrorFace strikes again, this time with Operation AkaiRyū targeting a European diplomatic organization. The attack features a comeback of ANEL backdoor, marking a shift from LODEINFO. While MirrorFace is known for targeting Japanese entities, this operation broadens their reach with a modified AsyncRAT in the mix.
Hot Take:
Looks like MirrorFace has decided to trade in their Japanese passport for a European vacation! But instead of sightseeing, they’re setting their sights on diplomatic drama. Who knew malware campaigns could have frequent flyer miles?
Key Points:
- MirrorFace, a China-aligned threat actor, targets a European diplomatic organization with ANEL backdoor malware.
- The attack is part of Operation AkaiRyū, a campaign with ties to APT10, also known as Earth Kasha.
- MirrorFace’s typical targets are Japanese entities, making this European attack a notable shift.
- The campaign uses a modified version of AsyncRAT and Visual Studio Code Remote Tunnels for stealthy access.
- Operation AkaiRyū overlaps with Campaign C, documented by Japanese cybersecurity authorities.
Already a member? Log in here