When Three Threats Meet One Inbox Against Japan

Unit Zero analysis details simultaneous Japan-focused activity by three distinct clusters — CoGUI (high-volume email phishing/PhaaS targeting credentials and cards), Smishing Triad (Lighthouse/Darcula-based SMS/iMessage smishing with aggressive anti-detection and bulk-SMS delivery), and MirrorFace/Earth Kasha (targeted, state-linked spearphishing and post-exploitation using ANEL/NOOPDOOR). The report examines convergence vs. coordination, infrastructure overlap, a possible Japanese localization-as-a-service ecosystem, provides IoCs (domains, IPs, hashes), defensive recommendations, and deployable detection rules (YARA, Suricata, Sigma).