Researchers at Trend Micro warn that the China-aligned threat actor Earth Kasha has launched a new spear phishing campaign targeting individuals and organizations in Japan.
“Specific targets include individuals affiliated with political organizations, research institutions, think tanks, and organizations related to international relations,” the researchers write.
“In 2023, Earth Kasha primarily attempted to exploit vulnerabilities against edge devices for intrusion but this new campaign reveals that they have once again changed their TTPs. This shift appears to be driven by a target change, moving from enterprises to individuals. Additionally, an analysis of the victim profiles and the names of the distributed lure files suggests that the adversaries are particularly interested in topics related to Japan’s national security and international relations.”
The spear phishing emails are written in Japanese and contain a link to a OneDrive folder that encourages recipients to download a ZIP file. The file purports to be a document related to an interview request or a report on geopolitical matters. The documents contain malicious macros which, if enabled, will install malware on the user’s device.
Trend Micro concludes, “Earth Kasha's campaigns are expected to continue evolving, with updates to their tools and TTPs. Many of the targets are individuals, such as researchers, who may have different levels of security measures in place compared to enterprise organizations, making these attacks more difficult to detect.
It is essential to maintain basic countermeasures, such as avoiding opening files attached to suspicious emails. Additionally, it is important to gather threat intelligence and ensure that relevant parties are informed. As this campaign is believed to be ongoing as of October 2024, continued vigilance is necessary.”
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.
Trend Micro has the story.
How BreachSim works:
