Glossary term
Cyber espionage
Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.
Read more
Significant cyber incident
MirrorFace campaigns against Japan, 2019 to 2025
In short
On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese organizations since about 2019 were run by an actor called MirrorFace. They described three campaigns, by email and through flaws in internet-facing devices, aimed at information on national security and advanced technology. The agencies assessed the activity as organized, with suspected Chinese involvement.
What happened
On 8 January 2025 the NPA and NISC published an alert about MirrorFace, also called Earth Kasha. They said cyberattack campaigns against organizations, businesses and individuals in Japan, from about 2019 to the present, were conducted by this actor.
The alert splits the activity into three campaigns. Campaign A (2019 to 2023) used emails with malicious attachments against think tanks, government including retirees, politicians and media. Campaign B (from around 2023) used flaws in internet-connected devices to enter networks, mainly at semiconductor, manufacturing, telecommunications, academic and aerospace targets. Campaign C (from around June 2024) used emails with links to download malware, aimed at academia, think tanks, politicians and media.
The NPA and NISC assessed the campaigns as a series of organized cyberattack activities with suspected Chinese involvement, mainly aimed at stealing information on national security and advanced technology. The alert does not name the individual victims.
The British broadcaster LBC, reporting the NPA statement, said Japanese authorities linked more than 200 attacks over five years to MirrorFace and that targets included the foreign and defense ministries and the space agency. The NPA text opened for this page does not give those numbers or name those bodies. LBC also calls the attacks “Chinese government-led”, while the NPA says “suspected Chinese involvement”, so sources differ on how firm the attribution is.
Timeline
-
About 2019
The NPA and NISC date the start of the campaigns attributed to MirrorFace to about 2019.
-
December 2019 to July 2023
Campaign A: emails with malicious attachments sent to think tanks, government, politicians and media. Some compromise from it continued until about May 2024.
-
June 2023 at the latest
The NPA says attackers were already using Windows Sandbox to run malware out of sight of security tools.
-
February to October 2023
Campaign B: VPN device flaws or credentials obtained by some means are used to enter networks of semiconductor, manufacturing, telecom, academic and aerospace targets.
-
About May 2024
The NPA still finds compromise caused by Campaign A infections.
-
June 2024
Campaign C starts: emails with links to download malware. Attackers also begin using the VS Code development tunnel feature (at the latest).
-
8 January 2025
The NPA and NISC publish the alert with methods, traces and detection advice. LBC reports it the same day.
-
7 February 2025
The NCO website lists the English alert "Cyberattacks by MirrorFace".
-
March 2026
The NPA's report on threats in 2025 repeats the assessment of organized activity likely involving China.
How the attack worked
The NPA alert and its two technical annexes describe three ways in. After entry the attackers used a few tricks that make their traces hard to find.
Campaign A: attachments (2019 to 2023)
Emails used Gmail or Outlook addresses, or genuine third-party addresses that had been abused. Subjects followed the security news of the day, such as the Japan-US alliance, the Taiwan Strait and the war in Ukraine. Opening the file led to infection with a tool called LODEINFO, and in some cases to LilimRAT or NOOPDOOR (Phishing, T1566).
Campaign B: internet-facing devices (2023)
The NPA says attackers entered through VPN devices, either through flaws or through credentials they had obtained. The flaws it names are in Array Networks (CVE-2023-28461), Fortinet FortiOS and FortiProxy (CVE-2023-27997) and Citrix ADC and Gateway (CVE-2023-3519) (Exploit Public-Facing Application, T1190). Tunnelling tools and web shells were placed on the devices (Web Shell, T1505.003). Attackers then reached Microsoft 365 and virtualisation servers, and took virtual machine images.
Campaign C: links (from June 2024)
Emails carried a link to download malware, with subjects such as interview requests and international affairs. The NPA says the bodies of the emails look like altered copies of earlier genuine emails, so they feel normal. Infection was with a tool called ANEL.
Hiding after entry
Windows Sandbox is a built-in temporary Windows environment. The NPA says attackers set it up to run malware inside it, which lets the malware avoid antivirus and EDR tools. Traces inside it are erased when the PC is shut down or restarted. From June 2024 at the latest attackers also used the development tunnel feature of Visual Studio Code to run commands remotely.
- Targeted emailMessages built around current security topics, or links to download filesTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Or a device flawIn Campaign B, VPN device flaws or obtained credentials give entryTechnique T1190 (MITRE ATT&CK, opens in a new tab)
- FootholdLODEINFO, ANEL or NOOPDOOR installed; tunnelling tools and web shells on VPN devicesTechnique T1505.003 (MITRE ATT&CK, opens in a new tab)
- HideMalware runs inside Windows Sandbox, out of sight of antivirus and EDR
- Remote controlVS Code development tunnels allow remote commands
- Reach dataMicrosoft 365, virtualisation servers and virtual machine images are accessed
ATT&CK techniques
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
- Technique Server Software Component: Web Shell (T1505.003) A web shell is a small script that an attacker places on a web server. T1505.003 · Persistence
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the NPA and NISC, 8 January 2025, to MirrorFace (also called Earth Kasha). They assess the campaigns as organized cyberattack activity with suspected Chinese involvement. LBC's report of the same statement calls the attacks "Chinese government-led", which is stronger wording than the NPA text, so sources differ in tone. The NPA text does not name a Chinese government body.
Impact
The NPA and NISC say the campaigns aimed at information on national security and advanced technology in Japan, and name target groups: think tanks, government including retirees, politicians, media, academia, and semiconductor, manufacturing, telecommunications and aerospace firms. The NPA text opened does not give a count of victims or say what was taken. LBC reports figures of more than 200 attacks and names the foreign and defense ministries and the space agency; those figures are not in the NPA pages opened, so treat them as unconfirmed here.
Government and regulator response
- 8 January 2025: the NPA and NISC published an alert with the campaigns, malware names, abused device flaws and detection and mitigation advice.
- 8 January 2025: the NPA published annexes on the Windows Sandbox and VS Code methods, with traces and detection tips.
- 7 February 2025: the English alert was listed on the NCO website.
- Advice in the alert: store logs centrally for a long period, review VPN logs, disable Windows Sandbox if the business does not use it, and replace devices that were ever compromised because patching may not remove a backdoor.
- March 2026: the NPA report on threats in 2025 repeats the assessment and says the NPA and NISC issued the alert.
Lessons
-
Mail built from real mail
The NPA says Campaign C email text looks like altered copies of genuine earlier emails. Staff cannot rely on "it reads normally" as a check.
-
Edge devices are a front door
Campaign B entered through VPN devices. Patch speed and credential hygiene on these devices matter as much as on servers.
-
Patching does not remove a backdoor
The NPA advises replacing a device that was ever compromised, since a patch may not remove what was left behind.
-
Built-in tools can hide malware
Windows Sandbox and VS Code tunnels are normal Microsoft features. Disable or watch them where the business does not need them.
-
Logs decide how far you can see
The NPA stresses central, wide and long log storage because attackers can erase logs on the systems they enter.
-
Long campaigns need long memories
The campaigns run from about 2019. Compromise from Campaign A was still found in May 2024.
What to check in your own organization
-
VPN and edge device flaws
List your VPN and gateway products and check whether CVE-2023-28461, CVE-2023-27997 and CVE-2023-3519 were ever open on them. Replace any device that was compromised.
-
VPN log review
Look for logins from abroad when staff are all in one country, odd user agents, and entries with loopback addresses as the source.
-
Windows Sandbox
If the business does not use Windows Sandbox, disable it and alert if it turns on again.
-
VS Code tunnels
Check whether VS Code is installed without a reason and watch for traffic to development tunnel services.
-
Mail with links to downloads
Treat password-protected zip files, VHD or ISO attachments and download links in unexpected mail as suspect, as the NPA advises.
-
Macros
Do not enable content in Office files from unexpected senders. Confirm with the sender by another route.
-
Central logs
Send logs from VPNs, directory servers and Microsoft 365 to one store that attackers cannot edit.
-
Contact route
Know how to report to the NPA, NISC (now NCO) or JPCERT/CC if you see these signs.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Japan Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific
Questions
Who is MirrorFace?
The NPA and NISC use the name MirrorFace, also Earth Kasha, for the actor behind the campaigns. They assess its activity as organized, with suspected Chinese involvement.
What did it want?
The NPA and NISC say the aim was mainly information related to national security and advanced technology in Japan.
How did it get in?
By email with attachments (Campaign A), by flaws in internet-facing devices such as VPNs (Campaign B), and by email with download links (Campaign C).
What is unusual about the tools?
The NPA says it used Windows Sandbox to hide malware from security tools and, from June 2024, the VS Code development tunnel feature for remote commands.
Is the 200 attacks figure official?
It comes from the LBC report of the NPA statement. The NPA pages opened for this page do not give it, so it is not confirmed here.
In our research
- MirrorFace Threat group
- Cyber espionage Glossary term
Sources
- Alert on cyberattacks by MirrorFace (8 January 2025) National Police Agency, Japan
- Alert: Cyberattacks by MirrorFace (provisional translation) National Police Agency, Japan
- Alert on cyberattacks by MirrorFace, full text (8 January 2025) NPA and NISC, Japan
- Annex: methods abusing Windows Sandbox (8 January 2025) National Police Agency, Japan
- Annex: methods abusing VS Code (8 January 2025) National Police Agency, Japan
- Threats in Cyberspace in 2025 (March 2026) National Police Agency, Japan
- National Cybersecurity Office, news list National Cybersecurity Office, Cabinet Secretariat, Japan
- Japan links Chinese hackers MirrorFace to dozens of cyber attacks (8 January 2025) LBC
- Phishing (T1566) MITRE ATT&CK
- Exploit Public-Facing Application (T1190) MITRE ATT&CK
- Web Shell (T1505.003) MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.