Japan Attributes More Than 200 Cyberattacks to China Threat Actor “MirrorFace”
Japan’s National Police Agency (NPA) has attributed more than 200 cyber incidents over the past five years to the China-aligned threat actor “MirrorFace,” Infosecurity Magazine reports.
The attacks, which began with spear phishing emails, targeted “Japanese think tanks, government (including retired employees), politicians, and individuals and organizations related to the media.”
Later campaigns also focused on organizations in the semiconductor, aerospace and academia sectors.
The NPA describes malware attacks that occurred from December 2019 through 2024. The spear phishing emails contained either a malicious attachment or a link to download the malware. Many of the phishing emails used geopolitical themes that would be of interest to the targeted individuals, such as “Japan-US alliance” or “Taiwan Strait.”
Once the malware was installed, it used advanced techniques to remain hidden for long periods of time.
The NPA reminds users to be wary of documents that ask you to enable macros, since this is a popular method for malware installation.
“When you open an attachment or downloaded file, you may be prompted to click the ‘Enable Content’ macro button in the Microsoft Office file, but do not do so carelessly,” the NPA says.
“Macros are convenient functions that can perform various processes automatically, but you should consider whether advanced functions such as macros are truly necessary to display and view the contents of the received file (papers, application forms, guides, etc.), and if you suspect something suspicious, check with the provider of the file.”
Phishing is used as an initial access vector by threat actors of all levels of sophistication because it’s so effective. New-school security awareness training can give your organization an essential layer of defense against targeted social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Infosecurity Magazine has the story.
Free Phish Alert Button
Do your users know what to do when they receive a phishing email? KnowBe4’s Phish Alert Button gives your users a safe way to forward email threats to the security team for analysis and deletes the email from the user’s inbox to prevent future exposure. All with just one click! Phish Alert benefits:
Here’s how it works:
- Reinforces your organization’s security culture
- Users can report suspicious emails with just one click
- Incident Response gets early phishing alerts from users, creating a network of “sensors”
- Email is deleted from the user’s inbox to prevent future exposure
- Easy deployment via MSI file for Outlook, Google Workspace deployment for Gmail (Chrome) and manifest install for Microsoft 365
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-reply-test-partner?partnerid=001a000001lWEoJAAW