China-linked hackers target Japan’s national security and high-tech industries – Source: www.csoonline.com

Japan’s National Police Agency (NPA) and the National Center of Incident Readiness and Strategy for Cybersecurity (NISC) have exposed a long-running cyber espionage campaign, “MirrorFace” (also known as Earth Kasha), allegedly linked to China.

The campaign, operational since 2019, has targeted Japanese organizations, businesses, and individuals, primarily to exfiltrate sensitive data related to national security and advanced technologies.

“It has been determined that the MirrorFace attack campaign is an organized cyberattack suspected to be linked to China, with the primary objective of stealing information related to Japan’s security and advanced technology,” the agencies said in a statement.

The agencies said this was confirmed based on an “analysis of the targets, methods, and attack infrastructure of the attacks.”

Japanese industries including aerospace, semiconductor, manufacturing, information and communications, and academics were the victims of this attack.

Other agencies that are involved in the probe include the Kanto Regional Police Bureau Cyber ​​Special Investigation Unit, the Tokyo Metropolitan Police Department, and other prefectural police departments.

This revelation sends a strong warning to enterprises operating in high-stakes sectors like technology, manufacturing, and defense to bolster their cybersecurity strategies against increasingly sophisticated and targeted threats.

A widespread campaign with evolving tactics

In a detailed briefing and technical reports, Japanese officials described MirrorFace’s modus operandi, which involved leveraging cutting-edge tools like Microsoft’s Windows Sandbox and Visual Studio Code’s development tunnels.

The attackers deployed malware, including LODEINFO and ANEL variants, to infiltrate systems, evade detection, and exfiltrate data, the agencies said in a document detailing the exploitation methods.

Windows Sandbox was exploited to create a virtualized environment where malware could run undetected. Tasks were triggered via scheduled commands, allowing malware to operate within sandboxed environments. Attack traces, including shared folder configurations and encrypted files, were wiped upon shutdown, making forensic investigations challenging​.

Similarly, attackers used Visual Studio Code’s development tunnels to establish covert connections, bypassing network defenses and remotely controlling compromised systems. Event logs and PowerShell commands in targeted systems provided insights into these breaches, the statement added.

The MirrorFace campaign stands out due to its use of spear-phishing, zero-day exploits, and highly covert malware, all meticulously designed to target Japan’s technological and national security assets. Experts believe these techniques reflect a calculated effort to avoid detection while extracting critical data.

“The MirrorFace campaign underscores how state-backed groups employ advanced tactics like spear-phishing, zero-day exploits, and sophisticated malware to infiltrate high-tech and national security targets,” said Arjun Chauhan, Senior Analyst at Everest Group. “The campaign’s focus on Japan’s cutting-edge research and defense sectors highlights the evolving nature of espionage, which is increasingly driven by strategic, economic, and geopolitical interests.”

Israeli cybersecurity firm Cybereason which tracks MirrorFace’s activities under the name Cockoo Spear says the “threat Actor persists stealthily on their victims’ network for years” and links it to “Chinese-state sponsored cyber espionage group APT10.”

“Cuckoo Spear is related to the APT10 Intrusion Set because of the links made between various incidents from Threat Actors Earth Kasha and MirrorFace including both APT10’s old arsenal (LODEINFO) and new arsenal,” Cybereason cited in its threat analysis report.

Enterprise threat landscape

MirrorFace’s modus operandi is characterized by advanced tactics, including spear-phishing, the deployment of malicious payloads like LODEINFO v8.0, and the exploitation of customized localized infrastructure for evasion.

The campaign has honed its ability to compromise high-value assets, such as intellectual property in cutting-edge research and proprietary technologies crucial to Japan’s strategic industries.

With Japan being a global hub for innovation, enterprises face heightened risks. Attackers are leveraging sophisticated social engineering techniques to infiltrate corporate networks, potentially threatening intellectual property and the financial bottom line. For multinational enterprises, these incidents are a stark reminder of the need to assess and reinforce cross-border cybersecurity postures.

Broader Implications for the business sector

The MirrorFace campaign poses significant challenges to enterprises dependent on secure supply chains, particularly in sectors like aerospace, automotive, healthcare, and telecommunications. According to an analysis provided in an NPA report, compromised supply chains can introduce hidden vulnerabilities, impacting operations far beyond national borders.

Small and medium enterprises (SMEs), often subcontractors in critical supply chains, are particularly vulnerable due to limited resources to invest in advanced cybersecurity frameworks. This highlights the importance of larger enterprises incorporating supply chain risk management as part of their broader security initiatives.

Experts highlight the importance of proactive cybersecurity measures in safeguarding sensitive organizational assets against threats like MirrorFace.

“Japanese organizations are probably already doing what they must or can,” said Yugal Joshi, Partner at Everest Group. “Some of these are basics like regular vulnerability assessment, penetration testing, hacker days, etc.”

Joshi emphasized that adopting advanced technologies is equally crucial. “For them to do cyber defense more diligently, they need well-staffed CISO functions and use AI and automation in their operations. In addition, leveraging learning from other parts of the world, which Chinese hackers have targeted, will also help them,” he noted.

He added that employee readiness must remain a top priority, particularly given the sophistication of phishing and social engineering tactics often employed by attackers. “Employees are the weakest link in cyber defense, and they need to be coached, educated, and constantly trained,” Joshi said.

Japan’s coordinated response

Japanese authorities have intensified their collaboration with private and public sector entities to prevent the recurrence of such breaches.

“By publicizing MirrorFace’s tactics, our goal is to arm enterprises and individuals with the knowledge to thwart similar attacks in the future,” the NPA said in its advisory.

Businesses are urged to implement robust incident response strategies, focusing on endpoint protection, advanced threat detection, and rigorous employee training to counter social engineering tactics. Large enterprises must prioritize collaboration with government cybersecurity bodies to gain actionable threat intelligence and enhance real-time defenses, the advisory added.