In Operation AkaiRyū, the China-aligned MirrorFace APT group expanded its targeting beyond Japan, attacking a Central European diplomatic institute using a spearphishing campaign related to Expo 2025. The group revived the ANEL backdoor, which was previously thought abandoned, and deployed a customized AsyncRAT to infiltrate the target, marking the first known European targeting by this threat actor. Back in March the same ESET report came up with its Windows Sandbox and VS Code remote tunnel tricks. Earlier this year, Japan’s National Police Agency and NISC attributed a series of campaigns since 2019 to MirrorFace, including one running since June 2024 that delivered ANEL via email links and abused VS Code and Windows Sandbox, though their alert only covers targets in Japan.
