Operation AkaiRyū
Campaign · ATTACK:enterprise:C0060
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0060",
"title": "Operation AkaiRyū",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0060",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--8a7c55ea-f363-4a03-b4c5-fa3fdb132d8f",
"external_id": "C0060",
"domain": "enterprise",
"created": "2026-04-17T20:03:43.454Z",
"modified": "2026-10-09T21:15:15.621Z",
"version": "1.0",
"aliases": [
"Operation AkaiRyū",
"AkaiRyū"
],
"tactics": [
],
"source_references": [
{
"source_name": "ESET MirrorFace 2025",
"url": "https://www.welivesecurity.com/en/eset-research/operation-akairyu-mirrorface-invites-europe-expo-2025-revives-anel-backdoor/"
},
{
"source_name": "Trend Micro Earth Kasha Anel NOV 2024",
"url": "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--039373a2-84b0-4780-b3ca-475ce5207a94
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04aedfef-4f86-414f-8465-4fdc3f419aa9
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0937991f-a349-4d87-96b4-856ed2c13f97
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S9026
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f8823f6-e82d-4ca9-b225-869adadc41b5
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--108fe161-3cea-4517-bd7c-4c623de4094f
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1585.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--119e8f52-ad4b-431f-b50a-bd59263451be
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13646672-412d-43e8-bd07-f54ef34d79f3
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22a3f284-c5b3-4e99-b278-0fdc33a8952b
ESET MirrorFace 2025ATTACK:enterprise:C0060 → attributed-to → ATTACK:enterprise:G1054
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2611f491-1c9d-4c2a-82da-8a9bcfc31870
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S9023
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--279ca916-0b6f-4eb9-8fe1-fec8e3cad47a
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1127.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e5b915d-21ee-4be2-8834-b09b2260ae5f
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4193ee99-a77c-47c7-97a4-7d3f3917242d
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41ef6c98-467f-4994-a264-1c4464e94acf
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S9027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a86d1f6-5f6a-4bd9-bc0c-d8c46d3233b8
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--606ec55f-09f7-4204-9b86-81ce32b9b96e
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S1087
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61b69adb-6adb-48e5-890a-c954af2e3170
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--699faca5-f170-4413-89ce-7fb7a69ca2d5
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6affe529-57fa-43f5-9ab8-6b59209dc74f
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1219.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b12862a-3b6f-4071-a049-b0fa4955bc45
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S0099
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95b3df3d-a1c9-421e-a1c4-8cdb2f0e75c0
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98396d16-6e9a-4eee-a806-a841ed334142
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1608.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--992c1bd2-c4f3-4de4-a6d2-852c942d51a7
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b9e1922-1b87-479d-8fcf-b75af9a0e850
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S0275
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9df1de87-dc8a-47df-b3b9-9ec6b55498dd
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1217
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a44fb8bd-e57d-4a75-8d4d-1b77f77d8b5f
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1219
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b46ccff3-bf2a-448a-9214-7490d422ce8f
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b711fa36-192b-4ad6-9462-790533469ce9
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1586.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8fe7b85-3b63-4881-9d26-9874eb2d7bdd
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf2a459d-7a6f-4945-a3f6-3dbf8a40a8c6
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1137.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3d716d9-a94d-49a7-af66-0166d9fe1f58
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1036.008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5f5995d-2792-4571-95c4-3085b843d917
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e59e3fc8-eba4-4874-9e51-7e8f88afe06b
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S1071
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f40c6e02-84bc-4453-a7c9-13e56944c38e
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:S1144
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f486f5ea-8a01-450b-b407-b8f76c8d8f3a
ESET MirrorFace 2025ATTACK:enterprise:C0060 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f58e5c25-e80b-45fb-8eb4-61daa2256842
ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024