Operation AkaiRyū Uses Expo 2025 Lures to Deliver ANEL

Summary

MirrorFace, a China-aligned threat actor, expanded its operations beyond Japan by targeting a diplomatic institute in Central Europe. The group introduced updated TTPs, including the return of the ANEL backdoor and deployment of a customized AsyncRAT variant. The campaign used Expo 2025-themed spearphishing lures to establish initial access.

Investigation

ESET conducted a forensic investigation in cooperation with the affected Central European diplomatic institute. Researchers uncovered a complex infection chain involving malicious LNK files, VBA code embedded in Word documents, and Windows Sandbox abuse to conceal malware execution. The investigation also identified Visual Studio Code remote tunnels used to maintain stealthy access.

Mitigation

Organizations should strengthen email filtering to identify spearphishing attempts and monitor endpoints for suspicious LNK file execution. Restricting unauthorized administrative tools and detecting unusual Windows Sandbox activity can reduce exposure. Defenders should also monitor for DLL side-loading and unauthorized creation of Visual Studio Code remote tunnels associated with these TTPs.

Response

If MirrorFace activity is detected, affected systems should be isolated immediately to limit lateral movement and further data exfiltration. Investigators should determine the scope of the compromise, focusing on evidence of Windows Sandbox abuse and malware stored in the registry. Windows event logs should also be reviewed for signs of deletion, modification, or other adversary tampering.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary initiates a spearphishing campaign using a malicious OneDrive link. Once the user interacts with the link, a downloader is triggered. In this simulation, we will emulate the final stage: the execution of a shell command that attempts to launch the AsyncRAT payload. To prove the rule’s efficacy, we will first run the “Noisy” version (which should trigger the alert) and then the “Evasive” version (which should bypass the rule by using an environment variable to break up the string).

• Regression Test Script:

  # --- STEP 1: The "Noisy" Attack (Should Trigger Detection) ---
  # Goal: Directly use the string 'AsyncRAT' in a PowerShell command.
  Write-Host "[!] Executing Noisy Attack..."
  Start-Process powershell.exe -ArgumentList "-Command Write-Host 'Initializing AsyncRAT payload...'"
  
  # --- STEP 2: The "Evasive" Attack (Should Bypass Detection) ---
  # Goal: Use an environment variable to prevent the string 'AsyncRAT' from appearing literally in the command line.
  Write-Host "[!] Executing Evasive Attack..."
  $part1 = "Async"
  $part2 = "RAT"
  Start-Process cmd.exe -ArgumentList "/c echo Starting $part1$part2 mechanism"

• Cleanup Commands:

  # No persistent files were created in this simulation. 
  # Only processes were spawned. No cleanup required.
  Write-Host "[+] Simulation complete. No artifacts left behind."