In Operation AkaiRyū, the China-aligned MirrorFace APT group expanded its targeting beyond Japan, attacking a Central European diplomatic institute using a spearphishing campaign related to Expo 2025. The group revived the ANEL backdoor, which was previously thought abandoned, and deployed a customized AsyncRAT to infiltrate the target, marking the first known European targeting by this threat actor. This campaign demonstrates MirrorFace’s evolving tactics, including the use of sophisticated tools like Windows Sandbox and Visual Studio Code remote tunnels to maintain stealthy access. Earlier this year, Japan’s National Police Agency and NISC warned that MirrorFace has been sending ANEL to Japanese academia, think tanks, politicians and media since around June 2024, abusing Windows Sandbox and VS Code after the intrusion. A follow-up in April notes that the same alert traces MirrorFace campaigns back to 2019.
