Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

Reviewed campaign intelligence

Operation AkaiRyū

Historical · OTHER · Global

Last reviewed:

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

This is a historical record and does not establish current campaign activity.

Threat actor
MirrorFace
Attribution confidence
Not established
First documented activity
2024-06-01
End date
Not established
Estimated victims
Not established
Reported impact
Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

  1. Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

  2. Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

MITRE ATT&CK techniques

  • T1204.001 · Malicious Link

    Execution — During Operation AkaiRyū, MirrorFace lured users into executing malicious payloads with links to resources hosted on OneDrive.(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

  • T1059.005 · Visual Basic

    Execution — During Operation AkaiRyū, MirrorFace used Word templates containing VBA code for malware execution.(Citation: ESET MirrorFace 2025)

  • T1588.002 · Tool

    Resource Development — During Operation AkaiRyū, MirrorFace deployed multiple publicly available tools including PuTTY, FRP, and Rubeus.(Citation: ESET MirrorFace 2025)

  • T1082 · System Information Discovery

    Discovery — During Operation AkaiRyū, MirrorFace collected system information.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1585.003 · Cloud Accounts

    Resource Development — During Operation AkaiRyū, MirrorFace established OneDrive accounts to host malicious payloads.(Citation: ESET MirrorFace 2025)

  • T1204.002 · Malicious File

    Execution — During Operation AkaiRyū, MirrorFace lured victims into executing malicious payloads by opening email attachments.(Citation: ESET MirrorFace 2025)

  • T1587.001 · Malware

    Resource Development — During Operation AkaiRyū, MirrorFace used custom malware, as well as customized variants of publicly available tools.(Citation: ESET MirrorFace 2025)

  • T1127.001 · MSBuild

    Stealth, Execution — During Operation AkaiRyū, MirrorFace used MSBuild to compile and execute its FaceXInjector injection tool.(Citation: ESET MirrorFace 2025)

  • T1685.005 · Clear Windows Event Logs

    Defense Impairment — During Operation AkaiRyū, MirrorFace cleared Windows event logs post compromise.(Citation: ESET MirrorFace 2025)

  • T1553.002 · Code Signing

    Defense Impairment — During Operation AkaiRyū, MirrorFace abused a signed McAfee executable to load UPPERCUT.(Citation: ESET MirrorFace 2025)

  • T1059.003 · Windows Command Shell

    Execution — During Operation AkaiRyū, MirrorFace used `cmd.exe` to run PowerShell commands to drop additional files on the compromised host.(Citation: ESET MirrorFace 2025)

  • T1016 · System Network Configuration Discovery

    Discovery — During Operation AkaiRyū, MirrorFace used Arp and `dir` for discovery in compromised environments.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1070.004 · File Deletion

    Stealth — During Operation AkaiRyū, MirrorFace deleted delivered tools and files from compromised hosts.(Citation: ESET MirrorFace 2025)

  • T1219.001 · IDE Tunneling

    Command And Control — During Operation AkaiRyū, MirrorFace abused Visual Studio Code (VS Code) remote tunnels to gain access and execute code on compromised machines.(Citation: ESET MirrorFace 2025)

  • T1083 · File and Directory Discovery

    Discovery — During Operation AkaiRyū, MirrorFace enumerated file system details in compromised environments.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1608.005 · Link Target

    Resource Development — During Operation AkaiRyū, MirrorFace used links to direct victims to malicious files hosted on OneDrive.(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

  • T1566.001 · Spearphishing Attachment

    Initial Access — During Operation AkaiRyū, MirrorFace distributed crafted spearphishing emails containing malicious attachments.(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1217 · Browser Information Discovery

    Discovery — During Operation AkaiRyū, MirrorFace exported Chrome web data including contact information, keywords, autofill data, and stored credit card information.(Citation: ESET MirrorFace 2025)

  • T1219 · Remote Access Tools

    Command And Control — During Operation AkaiRyū, MirrorFace used remote access tools including PuTTY.(Citation: ESET MirrorFace 2025)

  • T1566.002 · Spearphishing Link

    Initial Access — During Operation AkaiRyū, MirrorFace sent spearphishing emails with malicious OneDrive links.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1586.002 · Email Accounts

    Resource Development — During Operation AkaiRyū, MirrorFace used compromised accounts to send spearphishing emails.(Citation: Trend Micro Earth Kasha Anel NOV 2024)

  • T1047 · Windows Management Instrumentation

    Execution — During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.(Citation: ESET MirrorFace 2025)

  • T1137.001 · Office Template Macros

    Persistence — During Operation AkaiRyū, MirrorFace loaded malicious Word templates containing VBA code leading to installation of UPPERCUT.(Citation: ESET MirrorFace 2025)

  • T1036.008 · Masquerade File Type

    Stealth — During Operation AkaiRyū, MirrorFace disguised LNK and SFX (self-extracting) files as Word documents to lure victims into opening malicious files.(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

  • T1059.001 · PowerShell

    Execution — During Operation AkaiRyū, MirrorFace used PowerShell in execution chains to drop additional files such as embedded CAB files.(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

  • T1585.002 · Email Accounts

    Resource Development — During Operation AkaiRyū, MirrorFace used free email providers such as Gmail for spearphishing.(Citation: Trend Micro Earth Kasha Anel NOV 2024)(Citation: ESET MirrorFace 2025)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

  • MITRE ATT&CK C0060

    Official MITRE ATT&CK campaign record C0060. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.