Explore the emergence of the infamous Mirrorface group, known for its sophisticated cyberattacks on Japan using advanced techniques like anel and noopdoor.

Explore the emergence of the infamous Mirrorface group, known for its sophisticated cyberattacks on Japan using advanced techniques like anel and noopdoor.

Explore the emergence of the infamous Mirrorface group, known for its sophisticated cyberattacks on Japan using advanced techniques like anel and noopdoor.

Cybersecurity challenges facing Japan, particularly the threat of MirrorFace, a sophisticated malware operation linked to prolonged cyber-attacks.

In August 2024, ESET researchers detected cyberespionage activity carried out by the China-aligned MirrorFace advanced persistent threat (APT) group against a Central European diplomatic institute in relation to Expo 2025, which will be held in Osaka, Japan. Known primarily for its cyberespionage activities against organizations in Japan, to the best of our knowledge, this is the first time MirrorFace intended to infiltrate a European entity.

The group's Operation AkaiRyū begins with targeted spearphishing emails that use the upcoming World Expo 2025 in Osaka, Japan, as a lure 18 Mar 2025 The China-aligned MirrorFace APT group has targeted a Central European diplomatic institute, marking the first time this China-aligned APT group has attempted to infiltrate an entity in Europe, ESET research has found. In keeping with its previous campaigns, Operation AkaiRyū (which is Japanese for RedDragon) begins with carefully crafted spearphishing emails that, if successful, attempt to leverage legitimate applications and tools to install malware.

2025年1月8日、警察庁より標的型攻撃グループ「MirrorFace（ミラーフェイス、トレンドマイクロではEarth Kashaと呼称）」に関する注意喚起が公開されました。本稿では、2025年3月に観測した情報も踏まえ、「MirrorFace」がどのような攻撃グループか解説します。

Explore the emergence of the infamous Mirrorface group, known for its sophisticated cyberattacks on Japan using advanced techniques like anel and noopdoor.

MirrorFace deployed ROAMINGMOUSE and updated ANEL malware in March 2025 to target Japan and Taiwan's government systems

The MirrorFace cyber threat group has been observed using the ROAMINGMOUSE malware in a cyberespionage campaign targeting government agencies and public institutions in Japan and Taiwan. This activity, detected by Trend Micro in March 2025, involved the use of spear-phishing lures to deliver an updated version of the ANEL backdoor. Specific technical details regarding the delivery mechanisms and capabilities of the new version of ANEL were not provided in the article.

MirrorFace deployed ROAMINGMOUSE and updated ANEL malware in March 2025 to target Japan and Taiwan's government systems

The nation-state threat actor known as MirrorFace has been observed deploying malware dubbed ROAMINGMOUSE as part of a cyber espionage campaign directed against government agencies and public institutions in Japan and Taiwan. The activity, detected by Trend Micro in March 2025, involved the use of spear-phishing lures to deliver an updated version of a backdoor called ANEL. "The ANEL file from