Article Details
Scrape Timestamp (UTC): 2025-01-09 10:46:05.692
Source: https://thehackernews.com/2025/01/mirrorface-leverages-anel-and-noopdoor.html
Original Article Text
Click to Toggle View
MirrorFace Leverages ANEL and NOOPDOOR in Multi-Year Cyberattacks on Japan. Japan's National Police Agency (NPA) and National Center of Incident Readiness and Strategy for Cybersecurity (NCSC) accused a China-linked threat actor named MirrorFace of orchestrating a persistent attack campaign targeting organizations, businesses, and individuals in the country since 2019. The primary objective of the attack campaign is to steal information related to Japan's national security and advanced technology, the agencies said. MirrorFace, also tracked as Earth Kasha, is assessed to be a sub-group within APT10. It has a track record of systematically striking Japanese entities, often leveraging tools like ANEL, LODEINFO, and NOOPDOOR (aka HiddenFace). Last month, Trend Micro revealed details of a spear-phishing campaign that targeted individuals and organizations in Japan with an aim to deliver ANEL and NOOPDOOR. Other campaigns observed in recent years have also been directed against Taiwan and India. According to NPA and NCSC, attacks mounted by MirrorFace have been broadly categorized into three major campaigns - The agencies also noted that they observed instances where the attackers stealthily executed the malicious payloads stored on the host computer within the Windows Sandbox and have communicated with a command-and-control server since at least June 2023. "This method allows malware to be executed without being monitored by antivirus software or EDR on the host computer, and when the host computer is shut down or restarted, traces in the Windows Sandbox are erased, so evidence is not left behind," the NPA and NCSC said.
Daily Brief Summary
Japan's National Police Agency and NCSC have identified the China-linked MirrorFace group as responsible for ongoing cyberattacks since 2019.
MirrorFace, also known as Earth Kasha and categorized under APT10, primarily targets Japanese organizations to steal national security and advanced technology information.
The threat actor employs sophisticated tools such as ANEL, LODEINFO, and NOOPDOOR to infiltrate and execute attacks.
Recent reports from Trend Micro highlighted a spear-phishing campaign by MirrorFace aimed at delivering malware tools to Japanese targets.
The group has also conducted similar cyber operations against entities in Taiwan and India.
MirrorFace’s recent tactics include using the Windows Sandbox for executing malicious payloads stealthily to avoid detection and leaving no traces after system restarts or shutdowns.
The campaigns by MirrorFace are broadly classified into three major initiatives, signifying a highly organized and persistent threat to regional cybersecurity.