Operation AkaiRyū was an August 2024 intrusion into a Central European diplomatic institute, not a newly discovered 2026 campaign, and its Windows tradecraft deserves attention because MirrorFace combined ordinary user-facing tools — OneDrive, Word, PowerShell, Visual Studio Code, scheduled tasks, and Windows Sandbox — into a chain designed to leave investigators with very little on the host. ESET disclosed the case on March 18, 2025 after working with the victim; the recent recirculation of the campaign should not obscure that timeline.
The operation marked ESET’s first observed attempt by the China-aligned MirrorFace group, also known as Earth Kasha, to penetrate a European entity. The geographic expansion was real, but the lure remained tied to the group’s traditional Japan-focused collection priorities: Expo 2025 in Osaka. Japan’s National Police Agency and National Center of Incident Readiness and Strategy for Cybersecurity independently documented related MirrorFace activity beginning around June 2024 against Japanese academia, think tanks, politicians, and media, using ANEL, Windows Sandbox, and Visual Studio Code.
The more consequential finding is that this was not merely another phishing incident with a commodity remote-access tool attached. ESET found a deliberate shift in MirrorFace’s operating model: ANEL, an older backdoor associated with APT10, became the initial foothold; HiddenFace and customized AsyncRAT followed for persistence, remote control, and deeper access. That pattern gives Windows defenders a usable hunting model rather than a one-off phishing signature.
On August 26, 2024, the attackers sent the institute’s CEO a benign-looking email referencing a real prior interaction with a Japanese nongovernmental organization. The message used Expo 2025 as its pretext. Only after the recipient replied did the operators deliver a OneDrive link to a ZIP archive containing a shortcut named
That sequencing matters. Many email controls are better at inspecting a suspicious attachment or a first-contact link than a second-stage message in an existing-looking conversation. The attacker also relied on a familiar Windows deception: the
The CEO used a non-Windows system and forwarded the message to two employees, both of whom opened the shortcut on August 27. That detail undercuts a common assumption in security planning: protecting the apparent executive target is not enough when internal forwarding moves the malicious object to a less protected Windows endpoint. In this case, the forwarding step produced two compromised machines rather than none.
Once executed, the shortcut launched
The immediate detection opportunity is therefore broader than “block macros.” Security teams should treat a chain involving a downloaded archive, a disguised LNK,
Trend Micro had separately reported ANEL’s return in MirrorFace’s 2024 spearphishing activity, and Japan’s NPA and NISC confirmed ANEL in their “Campaign C” cluster. That independent overlap makes the revival more than an ESET-only attribution judgment. It also makes ANEL a practical priority for incident responders investigating past and current MirrorFace-like phishing activity.
ESET now assesses MirrorFace as a subgroup within the APT10 umbrella, citing ANEL, shared malware-code characteristics, and similar target interests. The group relationship remains an analytic assessment rather than a public government attribution, and Trend Micro has described the connection more cautiously. But for defenders, the operational conclusion is straightforward: detections and threat hunts built around APT10-associated ANEL activity should no longer assume Japan-only victimology.
ANEL was not a noisy persistence mechanism. ESET says it existed on disk only in encrypted form and was decrypted into memory by ANELLDR, communicating with command-and-control infrastructure over encrypted HTTP. It supports basic file operations, payload execution, and screenshot capture — enough capability to establish control while operators decide which more specialized tools to deploy.
The institute case illustrates the division of labor. ANEL appeared first. HiddenFace, MirrorFace’s modular backdoor, followed. On the IT employee’s machine, operators also deployed
Windows Sandbox is normally a defensive convenience: an isolated disposable desktop for testing untrusted content. Here, MirrorFace repurposed it to move malicious execution into a short-lived, separated environment, reducing visibility for controls focused on the main desktop session. ESET says the feature must be enabled manually and requires a reboot; it could not determine how MirrorFace enabled it on the compromised systems.
That uncertainty is an important limitation. The investigation established malware execution inside Windows Sandbox, but it did not establish a universal technique for remotely turning the feature on. Administrators should avoid treating every Sandbox-enabled Windows device as compromised. Instead, hunt for suspicious
The customized RAT added operational protections that are less typical of generic AsyncRAT deployments. ESET found support for victim-specific tags, Tor-routed communications to
Japan’s NPA and NISC independently confirmed VS Code abuse in Campaign C, so this is a recurring MirrorFace technique rather than a forensic curiosity unique to the European victim. Microsoft administrators should ensure endpoint telemetry covers
A blanket ban on VS Code is rarely practical in technical organizations. The better control is an allow-listing and role-based approach: identify approved developers, approved extension sources, and authorized remote-development hosts. A VS Code tunnel on a diplomatic, executive, finance, or general office endpoint should be treated differently from one on a managed engineering workstation.
ESET also observed cleanup designed to frustrate post-compromise reconstruction, including deletion of delivered tools and files and clearing Windows event logs. That means Windows Event Forwarding, EDR telemetry retention, proxy logs, OneDrive audit logs, and email-message trace data can be more valuable than the infected endpoint’s local logs after the fact. Keeping those records centrally is not administrative overhead in a case like this; it is the difference between seeing the delivery chain and seeing only its aftermath.
MITRE ATT&CK’s current Operation AkaiRyū campaign page contains a separate record-quality error: it identifies the campaign as first and last seen in June and September 2004. The page’s own description, ESET’s investigation, Japan’s NPA alert, and the underlying technical reporting place the relevant activity in 2024. MITRE created the campaign entry in April 2026, so the 2004 dates appear to be a decade error, not evidence of a 22-year-old campaign. Teams importing ATT&CK data into dashboards or case-management tools should correct the dates locally until MITRE updates the public record.
ESET could not determine whether the Chrome data collected from the project coordinator’s system — contacts, keywords, autofill data, and stored credit-card information — was exfiltrated. The institute began mitigation on August 29, 2024, and MirrorFace activity on the IT employee’s machine stopped after that day. The absence of confirmed exfiltration is not proof that none occurred; it is the boundary of what the forensic evidence could show.
For Windows defenders, the concrete response is to prioritize phishing conversations that evolve into OneDrive-hosted ZIP downloads, LNK execution from user download paths, Office templates loaded outside normal document workflows, suspicious DLL side-loading by signed utilities, unexpected Windows Sandbox launches, scheduled tasks that invoke
The more consequential finding is that this was not merely another phishing incident with a commodity remote-access tool attached. ESET found a deliberate shift in MirrorFace’s operating model: ANEL, an older backdoor associated with APT10, became the initial foothold; HiddenFace and customized AsyncRAT followed for persistence, remote control, and deeper access. That pattern gives Windows defenders a usable hunting model rather than a one-off phishing signature.
The Expo lure hid the payload until the target engaged
On August 26, 2024, the attackers sent the institute’s CEO a benign-looking email referencing a real prior interaction with a Japanese nongovernmental organization. The message used Expo 2025 as its pretext. Only after the recipient replied did the operators deliver a OneDrive link to a ZIP archive containing a shortcut named The EXPO Exhibition in Japan in 2025.docx.lnk.That sequencing matters. Many email controls are better at inspecting a suspicious attachment or a first-contact link than a second-stage message in an existing-looking conversation. The attacker also relied on a familiar Windows deception: the
.lnk file visually masqueraded as a Word document, including docx in its name, while the real .lnk extension could be hidden by Explorer’s default extension behavior.The CEO used a non-Windows system and forwarded the message to two employees, both of whom opened the shortcut on August 27. That detail undercuts a common assumption in security planning: protecting the apparent executive target is not enough when internal forwarding moves the malicious object to a less protected Windows endpoint. In this case, the forwarding step produced two compromised machines rather than none.
Once executed, the shortcut launched
cmd.exe and PowerShell to place additional files on the host. It opened a decoy Word document, tmp.docx, while loading a malicious global Word template, normal_.dotm, that contained VBA. The macro then used a legitimately signed JustSystems application to DLL-side-load and decrypt ANEL version 5.5.5 in memory.The immediate detection opportunity is therefore broader than “block macros.” Security teams should treat a chain involving a downloaded archive, a disguised LNK,
cmd.exe, PowerShell, an Office template under an unusual name, and a signed third-party executable loading an unexpected DLL as a high-confidence investigation trigger. Each element may be defensible in isolation; their sequence is not.
ANEL’s return changes the attribution picture
ANEL, also called UPPERCUT, had largely disappeared after late 2018 or early 2019, when researchers believed it had been superseded by MirrorFace’s LODEINFO backdoor. ESET’s observed 2024 samples used versions 5.5.4 and 5.5.5, a small increment from the older 5.5.0 lineage that ESET says points to resumed development rather than a recovered legacy implant.Trend Micro had separately reported ANEL’s return in MirrorFace’s 2024 spearphishing activity, and Japan’s NPA and NISC confirmed ANEL in their “Campaign C” cluster. That independent overlap makes the revival more than an ESET-only attribution judgment. It also makes ANEL a practical priority for incident responders investigating past and current MirrorFace-like phishing activity.
ESET now assesses MirrorFace as a subgroup within the APT10 umbrella, citing ANEL, shared malware-code characteristics, and similar target interests. The group relationship remains an analytic assessment rather than a public government attribution, and Trend Micro has described the connection more cautiously. But for defenders, the operational conclusion is straightforward: detections and threat hunts built around APT10-associated ANEL activity should no longer assume Japan-only victimology.
ANEL was not a noisy persistence mechanism. ESET says it existed on disk only in encrypted form and was decrypted into memory by ANELLDR, communicating with command-and-control infrastructure over encrypted HTTP. It supports basic file operations, payload execution, and screenshot capture — enough capability to establish control while operators decide which more specialized tools to deploy.
The institute case illustrates the division of labor. ANEL appeared first. HiddenFace, MirrorFace’s modular backdoor, followed. On the IT employee’s machine, operators also deployed
csvde, Rubeus, the FRP reverse-proxy tool, PuTTY, and an unrecovered executable disguised as oneuu.exe. ESET’s assessment was that the project coordinator’s system was used for personal-data collection, while the IT employee’s system was used to pursue deeper network access.Windows Sandbox became an evasion layer, not a containment boundary
MirrorFace’s customized AsyncRAT is the most Windows-specific part of AkaiRyū. ESET found it persisted through a scheduled task launched at system startup, then used a Windows Sandbox.wsb configuration file to execute a batch script in the sandbox. The script extracted AsyncRAT from a password-protected 7-Zip archive and created another scheduled task to run the RAT hourly.Windows Sandbox is normally a defensive convenience: an isolated disposable desktop for testing untrusted content. Here, MirrorFace repurposed it to move malicious execution into a short-lived, separated environment, reducing visibility for controls focused on the main desktop session. ESET says the feature must be enabled manually and requires a reboot; it could not determine how MirrorFace enabled it on the compromised systems.
That uncertainty is an important limitation. The investigation established malware execution inside Windows Sandbox, but it did not establish a universal technique for remotely turning the feature on. Administrators should avoid treating every Sandbox-enabled Windows device as compromised. Instead, hunt for suspicious
.wsb files, scheduled-task creation involving WindowsSandbox.exe, unexpected sandbox directory mappings, and archives or batch files staged alongside Sandbox configuration files.The customized RAT added operational protections that are less typical of generic AsyncRAT deployments. ESET found support for victim-specific tags, Tor-routed communications to
.onion command-and-control servers, a fallback domain-generation algorithm, and configured working hours. Those features reduce the value of basic network blocking alone: a system may be compromised without making traffic at the moment an analyst looks, and the infrastructure may vary by victim.
Visual Studio Code remote tunnels are the persistence clue many teams will miss
MirrorFace also used Visual Studio Code’s Remote Tunnels capability on both compromised computers. The feature is legitimate and allows a remote developer to connect to a machine hosting code and debugging resources. In an intrusion, it offers the attacker a Microsoft-adjacent remote-access path for executing commands and transferring additional tools without deploying a traditional remote-administration product.Japan’s NPA and NISC independently confirmed VS Code abuse in Campaign C, so this is a recurring MirrorFace technique rather than a forensic curiosity unique to the European victim. Microsoft administrators should ensure endpoint telemetry covers
code.exe command lines, tunnel-related processes and authentication activity, new VS Code installations on systems where development tooling is not expected, and outbound sessions from machines that should not be developer workstations.A blanket ban on VS Code is rarely practical in technical organizations. The better control is an allow-listing and role-based approach: identify approved developers, approved extension sources, and authorized remote-development hosts. A VS Code tunnel on a diplomatic, executive, finance, or general office endpoint should be treated differently from one on a managed engineering workstation.
ESET also observed cleanup designed to frustrate post-compromise reconstruction, including deletion of delivered tools and files and clearing Windows event logs. That means Windows Event Forwarding, EDR telemetry retention, proxy logs, OneDrive audit logs, and email-message trace data can be more valuable than the infected endpoint’s local logs after the fact. Keeping those records centrally is not administrative overhead in a case like this; it is the difference between seeing the delivery chain and seeing only its aftermath.
Two published records need correction before defenders rely on them
The submitted summary says defenders should look for malware “stored in the registry.” ESET’s full forensic account does not report ANEL or AsyncRAT being stored in the Windows Registry in this campaign. It reports ANEL encrypted on disk and decrypted in memory, with artifacts including LNK files, Word templates, DLL side-loading components, batch files, password-protected archives,.wsb configurations, scheduled tasks, and Visual Studio Code tunnels. Registry hunting can be sensible during a broad incident response, but presenting it as an AkaiRyū-specific artifact overstates the published evidence.MITRE ATT&CK’s current Operation AkaiRyū campaign page contains a separate record-quality error: it identifies the campaign as first and last seen in June and September 2004. The page’s own description, ESET’s investigation, Japan’s NPA alert, and the underlying technical reporting place the relevant activity in 2024. MITRE created the campaign entry in April 2026, so the 2004 dates appear to be a decade error, not evidence of a 22-year-old campaign. Teams importing ATT&CK data into dashboards or case-management tools should correct the dates locally until MITRE updates the public record.
ESET could not determine whether the Chrome data collected from the project coordinator’s system — contacts, keywords, autofill data, and stored credit-card information — was exfiltrated. The institute began mitigation on August 29, 2024, and MirrorFace activity on the IT employee’s machine stopped after that day. The absence of confirmed exfiltration is not proof that none occurred; it is the boundary of what the forensic evidence could show.
For Windows defenders, the concrete response is to prioritize phishing conversations that evolve into OneDrive-hosted ZIP downloads, LNK execution from user download paths, Office templates loaded outside normal document workflows, suspicious DLL side-loading by signed utilities, unexpected Windows Sandbox launches, scheduled tasks that invoke
.wsb files, and VS Code Remote Tunnels on non-development endpoints. AkaiRyū shows how a targeted actor can turn legitimate Windows features into a layered access stack — and how quickly the local evidence can disappear once the operator realizes the victim is responding.
References
- Primary source: SOC Prime
Published: 2026-08-03T06:40:35.904517
Loading…
socprime.com - Related coverage: digitalsecurityguide.eset.com
Loading…
digitalsecurityguide.eset.com - Related coverage: emerce.nl
Loading…
www.emerce.nl - Related coverage: thehackernews.com
Loading…
thehackernews.com - Related coverage: armed-atk.gitlab.io
Loading…
armed-atk.gitlab.io - Related coverage: technadu.com
Loading…
www.technadu.com - Related coverage: welivesecurity.com
Loading…
www.welivesecurity.com - Related coverage: eset.com
Loading…
www.eset.com - Related coverage: eset.com
Loading…
www.eset.com - Related coverage: wire.expertini.com
Loading…
wire.expertini.com