Operation AkaiRyū | Threat Actor Index

Techniques

Malware Used

Attributed Groups

Tactics Covered

About This Campaign

Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.

Attributed Groups

G1054

MirrorFace

🇨🇳 China43 techniques

Techniques by Tactic (26)

Resource Development

T1585.002 Email AccountsT1585.003 Cloud AccountsT1586.002 Email AccountsT1587.001 MalwareT1588.002 ToolT1608.005 Link Target

Initial Access

T1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1127.001 MSBuildT1204.001 Malicious LinkT1204.002 Malicious File

Persistence