Chinese APT Group Is Ransacking Japan's Secrets

Japanese authorities warn that MirrorFace, a Chinese state-backed APT active since 2019, has targeted think tanks, government, media, healthcare, manufacturing, education, and aerospace using spear-phishing, SQL injection, and exploitation of known Fortinet and Citrix vulnerabilities (including CVE-2023-28461, CVE-2023-27997, CVE-2023-3519); the group has deployed malware such as LODEINFO and MirrorStealer to steal credentials and exfiltrate sensitive information, with observed activity continuing into 2024.