A China-aligned hacking group known as MirrorFace, typically focused on Japanese targets, has now been observed targeting a diplomatic organization within the European Union, according to the Slovak cybersecurity firm ESET. This incident represents an expansion in MirrorFace’s usual scope, which until now has largely centered on Japanese institutions.
ESET’s latest report indicates that MirrorFace employed a spearphishing campaign with a Japanese-themed document, titled “The EXPO Exhibition in Japan in 2025,” as the bait for its target. Although the specific EU diplomatic organization remains unnamed, the targeting demonstrates MirrorFace’s enduring focus on Japan, with efforts now extending through Europe.
Japanese officials first noted MirrorFace’s growing activity in July, particularly its evolving interest in “media, political organizations, think-tanks, universities, manufacturers, and research institutions.” ESET has also tracked ongoing attacks against Japanese entities, including a political party and a research institute.
Japan has faced a surge in cyber incursions attributed to China-backed groups. In a major incident last year, Japan’s own cybersecurity agency revealed that it had been compromised, with attackers potentially accessing sensitive information for nine months before detection. Although Japan did not assign blame publicly, sources cited by the Financial Times suggested Chinese state-backed hackers as likely perpetrators.
Previous reports have highlighted a broader pattern of Chinese cyber activity against Japan’s critical infrastructure. In 2020, the U.S. National Security Agency discovered that Chinese military hackers had infiltrated Japan’s defense networks, an intrusion described as “one of the most damaging hacks” in Japanese history.
This latest move by MirrorFace signals a continued and expanding threat to Japanese interests, even beyond Asia.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
This group MirrorFace, is this group known for attracting young members?
Thanks for your comment, Veronique! From what we know, MirrorFace hasn’t focused on recruiting young members. Their activities have primarily centered on cyber espionage and election interference, particularly during the Japanese House of Councillors election in July 2022.
Ok, thanks for clarifying 👍
You’re welcome! 😎