MirrorFace APT: A Persistent Cyber Threat Targeting Japan

A Long-Running Espionage Operation

Japan's cybersecurity landscape has faced an ongoing challenge in the form of MirrorFace APT, a sophisticated cyber-espionage group believed to have ties to China. This threat actor has been orchestrating targeted attacks since at least 2019, focusing its efforts on infiltrating organizations, businesses, and high-profile individuals across Japan. Authorities from the National Police Agency (NPA) and the National Center of Incident Readiness and Strategy for Cybersecurity (NCSC) have pointed to MirrorFace as a major player in cyber operations aimed at gathering intelligence linked to national security and technological advancements.

MirrorFace and Its Connections to APT10

MirrorFace, also known as Earth Kasha, is considered an affiliate of the larger APT10 group, which has a history of conducting cyber-espionage activities against multiple nations. The group has utilized an array of custom and publicly available tools to execute its operations, including ANEL, LODEINFO, and NOOPDOOR (also referred to as HiddenFace).

The threat group is known for employing spear-phishing tactics and exploiting security vulnerabilities to infiltrate targeted systems. While Japan remains the primary focus, its operations have also been observed in Taiwan and India, suggesting a broader strategic interest.

Campaigns Unfolding Over Time

MirrorFace's activities have been categorized into three distinct campaigns, each employing specific techniques and tools to breach networks and exfiltrate data:

Targeting Political and Media Entities (2019–2023)

The first major campaign, spanning from December 2019 to July 2023, focused on political institutions, media outlets, government bodies, and research organizations. By deploying spear-phishing emails, the attackers distributed malicious payloads such as LODEINFO, NOOPDOOR, and a customized variant of Lilith RAT (LilimRAT), designed for information gathering and remote access.

Exploiting Security Weaknesses in Critical Industries (2023)

A second wave of attacks occurred between February and October 2023, shifting attention to industries critical to Japan's economic and technological infrastructure. Sectors such as semiconductor manufacturing, communications, aerospace, and academia were primary targets. This phase involved the exploitation of known vulnerabilities in internet-facing devices, particularly those associated with Array Networks, Citrix, and Fortinet. By leveraging these weaknesses, attackers deployed tools like Cobalt Strike Beacon, LODEINFO, and NOOPDOOR to gain a foothold within corporate networks.

Recent Tactics and Adaptation (2024–Present)

The latest known campaign, which emerged in June 2024, has once again focused on academia, research institutions, political figures, and media personnel. Spear-phishing remains the primary method of entry, with attackers delivering ANEL (also called UPPERCUT) to compromise systems and establish persistent access.

Advanced Techniques for Stealth and Persistence

MirrorFace has demonstrated an ability to adapt its tactics to bypass modern security measures. One of its notable techniques involves using Visual Studio Code remote tunnels, which allows the group to maintain covert control over compromised systems while evading detection.

Additionally, the group has been observed executing malicious payloads within Windows Sandbox, a feature designed for safe application testing. By running harmful code in this isolated environment, the attackers ensure that traces of their activities disappear when the system is restarted, preventing forensic analysis from uncovering crucial evidence.

Implications for Cybersecurity and Defense

The continued operations of MirrorFace highlight the evolving cyber threats facing Japan and the wider Asia-Pacific region. Given the group's focus on national security, technology, and industry, its activities could have significant implications for both governmental policies and private-sector security strategies.

Organizations operating in high-risk sectors must remain vigilant and adopt proactive cybersecurity measures to counter such threats. This includes strengthening email security, regularly updating software to patch known vulnerabilities, and deploying advanced detection tools capable of identifying unusual network activity.

A Continuing Cyber Conflict

The activities of MirrorFace APT underline the persistent nature of cyber espionage and the importance of coordinated cybersecurity efforts. While authorities have been able to track and analyze the group's methods, the ongoing challenge remains in mitigating its impact and staying ahead of future attacks. As threat actors continue refining their techniques, nations, and organizations must enhance their defenses to protect sensitive information from unauthorized access.