MITRE ATT&CKcampaign
C0060 Operation AkaiRyū
- Domain
- enterprise
- Aliases
- AkaiRyū
- Version
- 1.0
- Created
- 2026-04-17
Description
Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.
Related
Attributed to · MITRE ATT&CK (1)
- G1054 MirrorFace group
Uses · MITRE ATT&CK (34)
- S9027 ANELLDR software (malware)
- S9023 HiddenFace software (malware)
- S9026 ROAMINGHOUSE software (malware)
- T1685.005 Clear Windows Event Logs sub-technique
- T1219.001 IDE Tunneling sub-technique
- S1144 FRP software (tool)
- S1087 AsyncRAT software (tool)
- S1071 Rubeus software (tool)
- T1036.008 Masquerade File Type sub-technique
- T1585.003 Cloud Accounts sub-technique
- T1608.005 Link Target sub-technique
- T1585.002 Email Accounts sub-technique
- T1586.002 Email Accounts sub-technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1127.001 MSBuild sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1137.001 Office Template Macros sub-technique
- S0275 UPPERCUT software (malware)
- T1217 Browser Information Discovery technique
- T1219 Remote Access Tools technique
- S0099 Arp software (tool)