MirrorFace Hackers Targeting Japanese Government & Politicians Since 2019

Hacking

MirrorFace, also known as Earth Kasha, is a Chinese state-backed hacking group conducting cyber-espionage campaigns against Japan. Operating since 2019, their primary objectives include:

📂 Stealing information on Japanese technology🔍 Gathering national security intelligence

🚨 Recent investigations by the National Police Agency (NPA) and the Cabinet Cyber Security Center of Japan have confirmed ongoing activities by this group, highlighting three distinct campaign phases targeting various sectors.

💻 Campaign Overview:

1️⃣ Campaign A (2019–2023):

Targets: Think tanks, government entities, politicians, mediaMethod: Phishing emails deploying MirrorStealer and LODEINFO malware

2️⃣ Campaign B (2023):

Targets: Semiconductor, manufacturing, ICT, aerospace, academiaMethod: Exploited vulnerabilities in networking equipment (e.g., CVE-2023–28461, CVE-2023–27997, CVE-2023–3519)