{"id":57972,"date":"2025-01-09T07:06:44","date_gmt":"2025-01-09T07:06:44","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/japanese-police-claim-china-ran-five-year-cyberattack-campaign-targeting-local-orgs\/"},"modified":"2025-01-09T07:06:44","modified_gmt":"2025-01-09T07:06:44","slug":"japanese-police-claim-china-ran-five-year-cyberattack-campaign-targeting-local-orgs","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/japanese-police-claim-china-ran-five-year-cyberattack-campaign-targeting-local-orgs\/","title":{"rendered":"Japanese police claim China ran five-year cyberattack campaign targeting local orgs"},"content":{"rendered":"

Japan\u2019s National Police Agency and Center of Incident Readiness and Strategy for Cybersecurity have confirmed third party reports of attacks on local orgs by publishing details of a years-long series of attacks attributed to a China-backed source.<\/p>\n

The agencies have named the actor \u201cMirrorFace\u201d, aka \u201cEarth Kasha\u201d, and outlined<\/a> a campaign they allege started in 2019 and saw at least three waves of attack that continued into 2024. The agencies\u2019 report follows similar allegations raised last year by infosec vendors Trend Micro<\/a> and Broadcom<\/a>. The alleged attacker has also been linked to the APT 10 gang.<\/p>\n

The first wave of attacks ran from December 2019 to July 2023 and saw phishing emails sent to targets at think tanks, government agencies, politicians, and media organizations. The messages sometimes included malware in attached files, while others initiated conversations in which the sender offered to send info pursuant to the topic at hand and instead sent malware named \u201cLODEINFO\u201d, \u201cLilimRAT\u201d and \u201cNOOPDOOR\u201d. All are known malware strains.<\/p>\n