H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Campaign

Operation AkaiRyū

[Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by [MirrorFace](https://attack.mitre.org/groups/G1054) between June and September 2024 against entities in Japan and Central Europe. [Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) notably included the first reported targeting of a European entity by [MirrorFace](https://attack.mitre.org/groups/G1054), as well as their use of [UPPERCUT](https://attack.mitre.org/software/S0275), which was thought to be exclusive to [menuPass](https://attack.mitre.org/groups/G0045).(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

Campaign
TypeCampaign
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by [MirrorFace](https://attack.mitre.org/groups/G1054) between June and September 2024 against entities in Japan and Central Europe. [Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) notably included the first reported targeting of a European entity by [MirrorFace](https://attack.mitre.org/groups/G1054), as well as their use of [UPPERCUT](https://attack.mitre.org/software/S0275), which was thought to be exclusive to [menuPass](https://attack.mitre.org/groups/G0045).(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

35 recorded

Relationships

attributed-to
to MirrorFace
Group
uses
to ANELLDR
Malware
uses
to Arp
Tool
uses
to AsyncRAT
Tool
uses
to Browser Information Discovery
Technique
uses
to Clear Windows Event Logs
Technique
uses
to Cloud Accounts
Technique
uses
to Code Signing
Technique
uses
to Email Accounts
Technique
uses
to Email Accounts
Technique
uses
to File and Directory Discovery
Technique
uses
to File Deletion
Technique
uses
to FRP
Tool
uses
to HiddenFace
Malware
uses
to IDE Tunneling
Technique
uses
to Link Target
Technique
uses
to Malicious File
Technique
uses
to Malicious Link
Technique
uses
to Malware
Technique
uses
to Masquerade File Type
Technique
uses
to MSBuild
Technique
uses
to Office Template Macros
Technique
uses
to PowerShell
Technique
uses
to Remote Access Tools
Technique
uses
to ROAMINGHOUSE
Malware
uses
to Rubeus
Tool
uses
to Spearphishing Attachment
Technique
uses
to Spearphishing Link
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Tool
Technique
uses
to UPPERCUT
Malware
uses
to Visual Basic
Technique
uses
to Windows Command Shell
Technique
uses
to Windows Management Instrumentation
Technique
3 external

References

mitre-attack
C0060
open
ESET MirrorFace 2025
https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/
open
Trend Micro Earth Kasha Anel NOV 2024
https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance